pub fn format_contexts(role: &str, contexts: &[String]) -> StringExpand description
Human-readable context list — role-aware, because an empty
allowed_contexts means opposite things depending on the role.
AuthClaims::is_super_admin requires Role::Admin and an empty list;
has_context_access otherwise iterates allowed_contexts, and an empty
list matches nothing. So empty means “every context” for an admin and
“no context at all” for every other role.
Rendering both as (unrestricted) misled in both directions on a
security-relevant display: a correctly-scoped least-privilege approver
looked like a blanket grant, and an operator auditing for over-broad
access saw (unrestricted) on rows that were in fact inert.