pub struct ScopeSet { /* private fields */ }Expand description
A set of parsed SMART v2 scopes from a JWT token.
Retains the original raw scope tokens alongside the parsed resource scopes so
that operation scopes (e.g. system/bulk-submit), which do not match the
context/resourceType.permissions grammar and are therefore dropped by
SmartScope::parse, can still be inspected — see ScopeSet::grants_operation.
Implementations§
Source§impl ScopeSet
impl ScopeSet
Sourcepub fn parse(scope_str: &str) -> Self
pub fn parse(scope_str: &str) -> Self
Parse a space-delimited scope string (from JWT scope claim).
Non-SMART scopes (e.g., openid, profile) are silently ignored for
resource-permission checks but retained in ScopeSet::raw.
Sourcepub fn parse_array(scope_strs: &[String]) -> Self
pub fn parse_array(scope_strs: &[String]) -> Self
Parse from an array of scope strings (from JWT scp claim, e.g., Okta).
Sourcepub fn is_permitted(
&self,
resource_type: &str,
permission: SmartPermissions,
) -> bool
pub fn is_permitted( &self, resource_type: &str, permission: SmartPermissions, ) -> bool
Check if any scope grants the given permission on the given resource type.
Sourcepub fn scopes(&self) -> &[SmartScope]
pub fn scopes(&self) -> &[SmartScope]
Returns the parsed scopes.
Sourcepub fn raw(&self) -> &[String]
pub fn raw(&self) -> &[String]
Returns the raw, unparsed scope tokens exactly as presented in the token.
Sourcepub fn has_system_wildcard(&self) -> bool
pub fn has_system_wildcard(&self) -> bool
Returns true if any parsed scope is a system-level wildcard (system/*.<perms>).
Used as the ownership-bypass / broad-grant signal for bulk operations.
Sourcepub fn grants_operation(&self, name: &str) -> bool
pub fn grants_operation(&self, name: &str) -> bool
Returns true if the token grants the named system-level operation scope.
Matches the literal raw scope system/{name} (e.g. system/bulk-submit)
or any system-level wildcard scope (system/*.<perms>), which is treated
as granting all operations.