Trait ScopePolicy 

pub trait ScopePolicy: Send + Sync {
    // Required method
    fn ceiling(&self, did: &str, client_id: &str) -> ScopeSet;
}

The ceiling. PAR applies it to write the verdict an agent reads, and POST /oauth/token and every write apply it again to the login’s whole request (crate::oauth::token::in_force). An approval covers that request, so what a login may do moves with the ceiling.

Required Methods

fn ceiling(&self, did: &str, client_id: &str) -> ScopeSet

The most this did may ever hold from client_id. A ceiling only ever shrinks from GrantAnyScope’s; an empty ScopeSet refuses every non-empty request. Both arguments are ignored by every implementation here — see the module doc.

Implementors

impl ScopePolicy for ConfiguredCeiling

impl ScopePolicy for GrantAnyScope