Enum ActScope 

pub enum ActScope {
    None,
    All,
    Contexts(Vec<String>),
}

A DID’s authority to confer access through an approval, re-exported from the SDK.

The type lives in vta-sdk because the DIDComm and Trust Task update bodies carry it and must be constructible by clients that never link the server crates. Only the shape is shared — every authorization rule over it (validate_approve_scope_grant below) stays here. Same arrangement as crate::context_path. A DID’s authority to act — the contexts in which it may make a change. The sibling axis to ApproveScope, with deliberately identical variants, an identical covers predicate, and the same fail-closed None default.

Why this exists

Unlike ApproveScope, this is not a stored or wire field. The act axis is stored as (role, allowed_contexts), where an empty allowed_contexts means opposite things depending on the role: unrestricted for an admin (that is how a super-admin is spelled), and nothing at all for every other role. Reading the raw field without the role is therefore a bug, and has repeatedly been one — a display that called a least-privilege approver (unrestricted), two acl list --context filters that disagreed on whether an empty list matches every context or none, and a vault scope gate that granted cross-context reads to an entry authorized nowhere.

This type makes the three cases distinguishable so that decode happens in one place instead of at every call site. The decode itself is server-side (vti_common::acl::act_scope_for), because it needs Role; only the shape and the predicate are shared, exactly as for ApproveScope.

It lives beside ApproveScope so the two axes — what a DID may do and what it may confer — read as one model rather than an enum and a convention.

Variants

None

Authorized in no context at all (the fail-closed default). The shape of a least-privilege approver: acts nowhere, may still confer via its ApproveScope.

All

Authorized in every context. Combined with the admin role this is a super-admin.

Contexts(Vec<String>)

Authorized in these contexts and their subtrees, and only these.

Implementations

impl ActScope

pub fn covers(&self, context_id: &str) -> bool

Whether a holder of this scope may act in context_id.

Segment-aware ancestry, identical to ApproveScope::covers, so authority over a parent context covers its whole subtree.

pub fn is_unrestricted(&self) -> bool

Whether this scope authorizes every context (the super-admin condition when paired with the admin role).

pub fn acts_nowhere(&self) -> bool

Whether this scope authorizes nothing.

pub fn named_contexts(&self) -> &[String]

The contexts named by this scope, or an empty slice for None / All — neither of which is expressible as a list.

Trait Implementations

impl Clone for ActScope

fn clone(&self) -> ActScope

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ActScope

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for ActScope

fn default() -> ActScope

Returns the “default value” for a type.

impl Display for ActScope

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Operator-facing rendering. The unrestricted and acts-nowhere cases are spelled out rather than both collapsing to (unrestricted), which is what made them indistinguishable on ACL displays. The wording matches what vta-cli-common’s format_contexts already prints.

impl Eq for ActScope

impl PartialEq for ActScope

fn eq(&self, other: &ActScope) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ActScope