Trait ScopePolicy 

pub trait ScopePolicy: Send + Sync {
    // Required method
    fn resolve(&self, scope: &str) -> Option<Scope>;

    // Provided method
    fn principal(&self, subject: &str, scopes: &[Arc<str>]) -> String { ... }
}

What a deployment decides its own OAuth scope strings mean.

Not in domain/, and deliberately not a hardcoded table: the vendored spec names no scope strings, so any mapping written here would be this crate inventing a vocabulary and presenting it as policy. A deployment supplies the vocabulary it actually issues, and the default maps nothing — which means an unconfigured deployment refuses every token rather than granting one a scope nobody chose.

Required Methods

fn resolve(&self, scope: &str) -> Option<Scope>

The scope one authorization-server string confers, if any.

Provided Methods

fn principal(&self, subject: &str, scopes: &[Arc<str>]) -> String

The principal name to record, given the token’s subject and every scope it carries.

Separate from Self::resolve because the two are separate decisions: which scopes a token has is the authorization server’s statement, while what to call the principal is entirely local. A deployment that authenticates every user as "user" is not contradicting the token.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl ScopePolicy for NoScopes