Enum Scope 

pub enum Scope {
    Atproto,
    Transition(Transition),
    Repo {
        collection: NsidPattern,
        actions: ActionSet,
    },
    Rpc {
        method: NsidPattern,
        aud: Option<String>,
    },
    Blob {
        accept: Vec<MimePattern>,
    },
    Identity {
        attr: IdentityAttr,
    },
    Account {
        attr: AccountAttr,
        action: AccountAction,
    },
    Include {
        nsid: String,
        aud: Option<String>,
    },
    Unknown(String),
}

One parsed scope atom.

Variants

Atproto

The base atproto scope every grant carries.

Transition(Transition)

A legacy transition:* scope.

Repo

repo:<collection>[?action=...].

Fields

collection: NsidPattern

The collection this scope covers, exact or wildcard.

actions: ActionSet

Which write actions are covered.

Rpc

rpc:<lxm>[?aud=...].

Fields

method: NsidPattern

The XRPC method this scope covers, exact or wildcard.

aud: Option<String>

The audience this scope is bound to, percent-decoded: a DID, a DID and a service fragment, or * for every audience.

Blob

blob:<mime> or blob?accept=<mime>[&accept=<mime>…].

Fields

accept: Vec<MimePattern>

The MIME types this scope covers, exact or wildcard. Sorted, deduplicated, and never empty — see Scope::blob.

Identity

identity:<attr>. This server never grants one; see plan/scope-policy.md.

Fields

attr: IdentityAttr

The part of the account’s identity this scope names.

Account

account:<attr>[?action=...]. Never granted either.

Fields

attr: AccountAttr

The part of the account’s hosting this scope names.

action: AccountAction

How much control over it this scope grants.

Include

include:<nsid>[?aud=...] — a permission set. As an atom it admits only itself; crate::Include reads what it grants.

Fields

nsid: String

The set’s name, percent-decoded. crate::Include::new says whether it names a set at all.

aud: Option<String>

The audience the set’s inheritAud permissions take, percent-decoded.

Unknown(String)

An atom this grammar cannot read as any scope above: an unknown kind, such as space:*, or a value its kind does not define, such as account:status. Kept as written, it admits only itself.

Implementations

impl Scope

pub fn parse(atom: &str) -> Result<Scope, ScopeParseError>

Parses an atom that names one scope, such as repo:app.bsky.feed.post?action=create, whatever its form’s warnings.

An atom that lists several collections or methods names a scope for each, and ScopeSet::parse is what reads it. So does an atom this grammar cannot read, which ScopeSet::parse keeps as Scope::Unknown and this refuses.

pub fn contains(&self, other: &Scope) -> bool

Does self admit every request that other admits?

Reflexive and used both directions by ScopeSet::intersect: a ceiling contains a requested scope, or a requested scope is itself a (possibly equal) subset of the ceiling’s scope.

pub fn intersect(&self, other: &Scope) -> Option<Scope>

The most specific scope both self and other admit in common, if their admitted requests overlap at all.

None is a real refusal, not an error: it means the two scopes name disjoint capabilities (a repo: ceiling for one collection against a request for a different one, say), and the caller — scope-policy’s ceiling check — is expected to report that by name.

pub fn repo_write(collection: &str, action: Action) -> Scope

The repo: scope one record write needs: action on exactly collection.

pub fn blob(accept: Vec<MimePattern>) -> Scope

A blob: scope over accept, canonical: sorted, deduplicated, and with any pattern another one already covers dropped, so blob?accept=image/*&accept=image/png is blob:image/*.

Panics

If accept is empty. Every caller builds it from something.

pub fn blob_upload(mime_type: &str) -> Scope

The blob: scope one upload needs: the type it declared.

The type is taken up to any ; — image/png; charset=binary is an upload of image/png — and one that is not type/subtype at all is taken as application/octet-stream, which is what an unreadable content type means anyway.

Trait Implementations

impl Clone for Scope

fn clone(&self) -> Scope

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Scope

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Display for Scope

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Ord for Scope

fn cmp(&self, other: &Scope) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for Scope

fn eq(&self, other: &Scope) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd for Scope

fn partial_cmp(&self, other: &Scope) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Eq for Scope

impl StructuralPartialEq for Scope