Function scope_grants_collection_op 

pub fn scope_grants_collection_op(
    scope: Option<&str>,
    resource_type: &str,
    action: &str,
) -> bool

Returns true when a scoped token is itself sufficient authorization for a collection-level operation, letting the middleware skip the role/quota path.

A file share link with Write access authorizes file creation only; the file handlers (check_scope_allows_create_in) then enforce the scope’s subtree boundary. It must NOT authorize action/app creation, trash emptying, or any other collection operation.