Struct ConfiguredCeiling 

pub struct ConfiguredCeiling(ScopeSet);

The ceiling an operator wrote down, applied to every agent and every client alike.

plan/scope-policy.md’s “from server configuration first”: an enumeration of scope atoms, not a pattern, read out of didbot_config::sections::OAuthSection::scope_ceiling. Per-agent and per-client profiles are the operator’s repository’s to hold, and this ignores both arguments until that exists.

A seam, not a destination. plan/policy-store.md’s ceiling — read from policy records in the operator’s repository, per agent and per client — implements this same ScopePolicy trait and replaces this implementation whole when it lands; nothing that calls a ceiling has to change for it. What it needs first is an account on didbot_policy::Subject::Grant, which is what a per-account rule would have to match on.

It can only narrow. ConfiguredCeiling::new intersects what it was given with GrantAnyScope’s own ceiling and keeps the overlap, so a configured atom outside the compiled-in ceiling — anything in plan/scope-policy.md’s hard-blocked set, or a kind: a later grammar adds — grants nothing however it is spelled in the file. That is what lets a scope live in a configuration file at all; see didbot_config’s own crate doc.

Tuple Fields

0: ScopeSet

Implementations

impl ConfiguredCeiling

pub fn new<'a>(atoms: impl IntoIterator<Item = &'a str>) -> (Self, DroppedAtoms)

Builds a ceiling from the atoms an operator enumerated, dropping every one the compiled-in ceiling does not already admit.

An atom is kept only if the compiled-in ceiling admits it whole. A partial admission is dropped rather than kept at its projection: transition:generic overlaps repo:* rpc:*, and an operator who wrote a hard-blocked atom should get nothing for it rather than the slice of it that happens to fall inside. An atom that does not parse is dropped for the same reason — this runs at startup, and a ceiling that fails closed on the atoms it understood is the safe reading of a file it only half understands. The dropped atoms are returned so the caller can log them.

Bounded at crate::oauth::scope::MAX_SCOPE_ATOMS. ScopeSet::new compares every pair of atoms it is handed, and that constant is what bounds the comparison — which it does for ScopeSet::parse, applied per string, but each configured atom is parsed on its own here and the results accumulate. Without this a configuration file naming a few thousand atoms is a few million comparisons at boot.

pub fn scopes(&self) -> &ScopeSet

What this ceiling admits, for a caller that wants to log or show it.

Trait Implementations

impl Clone for ConfiguredCeiling

fn clone(&self) -> ConfiguredCeiling

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ConfiguredCeiling

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ScopePolicy for ConfiguredCeiling

fn ceiling(&self, _did: &str, _client_id: &str) -> ScopeSet

The most this did may ever hold from client_id. A ceiling only ever shrinks from GrantAnyScope’s; an empty ScopeSet refuses every non-empty request. Both arguments are ignored by every implementation here — see the module doc.