Expand description
Granted-vs-requested scope validation (RFC 6749 §5.1).
A phantom scope marker types what the client asks for. What it
gets is a runtime fact the server decides, and the two can differ:
an authorization server may narrow a grant at the token endpoint, and
OAuth 2.1 §1.3.2 explicitly permits a refresh response to carry a
narrower scope than the token it renews. Without a check, a client whose
type says Notify can be running on a credential that lost chat.ack
— and the discrepancy surfaces as a puzzling 403 from the resource
server, arbitrarily far from the cause.
ensure_covers is that check, in one place, used by every leg of the
SDK that receives a token response.
Structs§
- Scope
NotCovered - The server granted a scope that does not cover what was requested.
Functions§
- ensure_
covers - Check that a token response’s scope echo covers
S’s atoms.