Module capabilities 

Account-level capabilities (entitlements) shared across services.

Distinct from API-key crate::permissions (per key) and roles (operational). A user is granted a default set at registration; the platform admin can restrict/grant per user. The effective set is computed in the identity service and propagated to every service as the signed x-auth-capabilities header; enforcement is per-endpoint via crate::UserContext::require_capability.

Constants

ACCOUNT_READ

Read account data (balances / orders / history).

ALL

Every known capability, in canonical order.

API_ACCESS

Create / use API keys.

DEFAULT_ON

Capabilities granted to every user at registration (everything except fiat, which the admin enables explicitly).

DEPOSIT_CRYPTO

Crypto deposits.

EARN_STAKE

Earn / staking.

FIAT_DEPOSIT

Fiat deposits (off by default).

FIAT_WITHDRAW

Fiat withdrawals (off by default).

SPOT_TRADE

Place / cancel spot orders.

TRANSFER_INTERNAL

Internal transfers.

WITHDRAW_CRYPTO

Crypto withdrawals.

Functions

is_default_on

True when cap is on by default at registration.

is_valid

True when cap is a recognized capability.