Module token_scope 

Per-tenant scoped bearer tokens.

Implements PATH-TO-V1 v0.4 exit-criterion Scoped tokens: each accepted bearer token carries a TokenScope describing which tenants it may address. Routes that bind to a tenant call crate::rate_limit::AuthContext::authorize_tenant before doing any per-tenant work and return 403 Forbidden { kind: "tenant_scope_denied" } when the caller’s token does not cover the requested tenant.

Wire format for TENSOR_WASM_API_TOKENS

Two entry shapes are accepted in the comma-separated allowlist:

1. token1:tenant=1,2,3 — scoped: the token grants access to tenants 1, 2, and 3 only.
2. token1:tenant=* — wildcard: the token grants access to every tenant.
3. token1 — bare (legacy): treated as the wildcard form with a one-time deprecation warning emitted at startup. Scheduled for removal in v1.0.

Forms can be mixed in the same env var; the parser splits on commas at the top level only. Because tenant lists are themselves comma-separated and live inside an entry, the parser groups all comma-separated values that follow a :tenant= clause back into a single entry.

Parser strategy

The grammar is small enough that hand-rolling a one-pass scanner is the lowest-overhead choice. We split the input on commas to obtain raw pieces, then walk them left-to-right, joining pieces back together when we observe a piece that is itself a continuation of a :tenant= clause (i.e. it starts with neither a token name nor a colon — a numeric or * continuation list). The walker accepts the same trailing whitespace the pre-existing parser does (split(',').map(str::trim)).

Structs

ParsedTokens

Output of parse_tokens_env.

TokenScope

Authorization metadata derived from a single bearer-token entry.

Enums

ScopeParseError

Errors produced when parsing a single token entry. The wrapper around parse_tokens_env turns each into a startup-time tracing::warn! rather than aborting the process — the gateway prefers to keep the remaining valid entries.

TenantScope

Tenant scope attached to a single bearer token.

Functions

parse_token_entry

Parse a single entry of the TENSOR_WASM_API_TOKENS allowlist.

parse_tokens_env

Parse the TENSOR_WASM_API_TOKENS env-var value into a map of bearer → scope, plus a count of legacy (bare) entries that were coerced to the wildcard scope.

Type Aliases

BearerString

Alias for the raw bearer-token string used as the map key in ParsedTokens. Kept as a type alias rather than a newtype because the existing crate::middleware::AuthConfig also stores the raw string.