Struct ScopeEnforcementLayer 

pub struct ScopeEnforcementLayer { /* private fields */ }

Tower layer that enforces OAuth scope requirements at the MCP request level.

Unlike OAuthLayer which operates at the HTTP transport level, ScopeEnforcementLayer operates on RouterRequest and can perform per-operation scope checks (e.g., different scopes for different tools).

The middleware extracts TokenClaims from RouterRequest::extensions. If no claims are present, the request is rejected. Use ScopeEnforcementLayer::permissive_without_claims only when a surrounding component intentionally supports unauthenticated requests.

Example

use std::time::Duration;
use tower_mcp::McpRouter;
use tower_mcp::oauth::{ScopePolicy, ScopeEnforcementLayer};
use tower_mcp::transport::http::HttpTransport;

let policy = ScopePolicy::new()
    .default_scope("mcp:read")
    .tool_scope("admin_tool", "mcp:admin");

let router = McpRouter::new().server_info("my-server", "1.0.0");
let transport = HttpTransport::new(router)
    .layer(ScopeEnforcementLayer::new(policy));

Implementations

impl ScopeEnforcementLayer

pub fn new(policy: ScopePolicy) -> Self

Create a new scope enforcement layer with the given policy.

pub fn permissive_without_claims(policy: ScopePolicy) -> Self

Create a layer that skips scope checks when authentication claims are absent.

This is an explicit opt-out from fail-closed behavior. Prefer Self::new for protected MCP endpoints.

Trait Implementations

impl Clone for ScopeEnforcementLayer

fn clone(&self) -> ScopeEnforcementLayer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ScopeEnforcementLayer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<S> Layer<S> for ScopeEnforcementLayer

type Service = ScopeEnforcementService<S>

The wrapped service

fn layer(&self, inner: S) -> Self::Service

Wrap the given service with the middleware, returning a new service that has been decorated with the middleware.