pub trait ScopedTokenSource<S>: TokenSourcewhere
S: ConsentScopes,{ }Expand description
A TokenSource whose credential has
been checked to cover S’s atoms.
This is a witness, not a capability: implementing it asserts that at the
moment the token was obtained, the server’s granted scope was verified to
contain every atom in S::SCOPES (absent echo = granted-as-requested,
RFC 6749 §5.1). A consumer can then require the same S for acquisition
and for use, so a credential requested at one tier cannot be fed to a
client built at another — a mismatch that otherwise compiles cleanly and
fails as a runtime 403 on the first call that needs the missing atom.
§What it does not do
Rust has no cross-crate privacy sharing, so this marker is not unforgeable — a determined consumer can implement it on a type where no check ever ran. Containment is by constructor discipline: the SDK implements it only where a covers-check has actually run, and any public constructor that yields one must itself take the granted scope line and run the check. That makes the coherent path the easy path, which is the honest claim; the server-side scope enforcement remains the authorization boundary. Dev/test sources that cannot know their grant (a statically supplied token) deliberately do not implement this, so reaching for one is opt-out by construction rather than an accident.
Gated on token-cache, the feature that owns
TokenSource; every SDK that mints or
renews credentials already enables it.
Dyn Compatibility§
This trait is dyn compatible.
In older versions of Rust, dyn compatibility was called "object safety".
Implementors§
impl<P: PasAuthPort, T: TokenStore, Sc: ConsentScopes> ScopedTokenSource<Sc> for RefreshTokenSource<P, T, Sc>
The witness: every token this source yields has passed ensure_covers
against Sc. See the type’s docs for why the guarantee attaches to use
rather than construction.