Struct CardRefScope 

pub struct CardRefScope(/* private fields */);

A principal’s card authorization set.

Authorization is identity-based on (kind, name, version). The optional resolved uid is ignored.

Implementations

impl CardRefScope

pub fn as_slice(&self) -> &[CardRef]

Borrow scope members.

pub fn is_empty(&self) -> bool

Whether the scope has no members.

pub fn len(&self) -> usize

Number of scope members.

pub fn from_root_and_members( root: &CardRef, members: impl IntoIterator<Item = CardRef>, ) -> CardRefScope

Build a scope and guarantee that root is the first member.

Duplicate identity (same (kind, name, version), ignoring uid) is removed. Root is always retained as the first element.

A duplicate that carries a resolved uid donates it to the retained entry. Mint resolves each scope member against the tenant-local registry while its callers still hold the authored, UID-less root, so without this the resolved root identity would be dropped and ingest could not stamp subject_card_uid from signed claims alone.

pub fn own(root: &CardRef) -> CardRefScope

Build an own-card-only scope.

Passing this as card_ref_scope on issuance is the canonical way to express “this token is scoped only to its own card.” An empty card_ref_scope on a received wire token carries the same meaning and is upgraded to own by the verifier’s seed_scope call.

pub fn permits_root(&self, root: &CardRef) -> bool

True when the scope is empty (vacuously) or contains the root card.

An empty scope is permitted because the wire format omits the scope field for own-scoped tokens and the verifier upgrades it to own(root) via seed_scope. If you need a stricter guarantee that the root was explicitly present at construction time, use authorizes on a non-empty scope.

pub fn authorizes(&self, card: &CardRef) -> bool

Return true when card is authorized by identity.

pub fn uids(&self) -> Vec<CardUid>

The resolved UIDs of this scope’s members, in member order.

This is the set a row’s subject_card_uid correlation is authorized against: the UIDs the mint signed onto the scope. A member without a resolved UID contributes none, so no row can correlate to it.

Trait Implementations

impl Clone for CardRefScope

fn clone(&self) -> CardRefScope

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CardRefScope

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for CardRefScope

fn default() -> CardRefScope

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for CardRefScope

fn deserialize<D>( deserializer: D, ) -> Result<CardRefScope, <D as Deserializer<'de>>::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for CardRefScope

impl PartialEq for CardRefScope

fn eq(&self, other: &CardRefScope) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for CardRefScope

Serializes as a JSON array of Display strings ("Kind/name@version").

This is the canonical wire encoding for card_ref_scope members in JWT claims and HTTP payloads. Individual card_ref fields use an object shape instead — this asymmetry exists because scope members are positional (root-first) and compact by design. An empty array means “own-card scope”; the verifier upgrades it to own(root) via seed_scope.

fn serialize<S>( &self, serializer: S, ) -> Result<<S as Serializer>::Ok, <S as Serializer>::Error>

where S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for CardRefScope