Module include 

What an include: scope names, and what the permission set it names grants.

A permission set is a lexicon: a permission-set definition published under the set’s own NSID, whose permissions are repo and rpc permissions in their JSON form. Include::grants reads that list the way the permission spec’s “Permission Sets” section says an authorization server must:

• It ignores a permission for any other resource, and a permission with a field or a value it cannot read. It never grants a permission in part.
• Every collection and method must sit under the set’s own NSID group. app.example.authFull may grant app.example.post and app.example.feed.like, and nothing under app.other. A wildcard is never one of them.
• An rpc permission names * as its audience, or sets inheritAud and takes the audience the include: scope names. With inheritAud and no audience to take, it grants nothing.

Finding the set is the caller’s job: the DNS record, the authority’s repository, and the proof the record comes with.

Structs

Include

An include: scope, read: the permission set it names, and the audience that set’s rpc permissions may inherit.

Enums

IncludeError

Why an include: scope names no permission set.

Functions

has_only 🔒

Some when every field of permission is type, resource, description, or one of fields.

is_fragment 🔒

Whether fragment is a non-empty RFC 3986 fragment: pchar, / and ?, with % only as an escape.

is_service_reference 🔒

Whether aud names one service: a did:plc or a did:web, then # and a fragment.

repo_actions 🔒

A non-empty list of distinct repo actions, or None.