Struct Scope 

pub struct Scope {
    pub root: String,
    pub publish: Patterns,
    pub subscribe: Patterns,
}

The immutable ceiling on what a key may grant, embedded in its JWK.

Patterns in publish and subscribe are relative to root, matching token claim semantics. A key signs a token only when every pattern the token grants is contained by one the scope allows, in the same role; see allows.

The scope is fixed at key generation. Widening it means minting a new key, which is the point: a leaked scoped key can never be talked into signing more than it already could. A key with no scope at all is unrestricted, so keys minted before scopes existed keep working.

Legacy put/get prefix scopes load as subtree patterns, and a scope that only grants subtrees is written that way so older readers load it too.

Fields

root: String

The root for the publish/subscribe patterns below.

publish: Patterns

Patterns this key may grant to publishers.

subscribe: Patterns

Patterns this key may grant to subscribers.

Implementations

impl Scope

pub fn validate(&self) -> Result<()>

Returns an error when the scope permits nothing, making the key unusable.

pub fn allows(&self, claims: &Claims) -> bool

Whether every pattern claims grants is covered by this scope, per role.

Both sides are placed beneath their own root before comparing, so the same grant expressed as root: "demo" + publish: ["room/**"] or as publish: ["demo/room/**"] is treated identically. Containment is per pattern, so a scope of live/** does not cover lively/**, and the roles are checked independently: a publish-only scope never authorizes a subscribe grant.

** covers everything beneath the scope root, so a scope of root: "demo" + publish: ["**"] grants publish anywhere under demo.

Trait Implementations

impl Clone for Scope

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Scope

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Scope

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Scope

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Scope

impl PartialEq for Scope

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Scope

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Scope