Struct DecisionSeams 

pub struct DecisionSeams<'a> {
    pub scope_policy: &'a dyn ScopePolicy,
    pub consent_store: &'a dyn ConsentStore,
    pub decisions: &'a dyn DecisionStore,
    pub gate: &'a dyn PolicyGate,
    pub evaluation_log: &'a EvaluationLog,
    pub pds_did: &'a str,
    pub pds_hostname: &'a str,
    pub loopback_clients: LoopbackClients,
    pub client_assertions: &'a ClientAssertionVerifier,
    pub issuer: &'a str,
    pub permission_sets: &'a PermissionSets,
}

The seams PAR reaches to work out what it would grant, bundled so push_authorization_request takes one argument rather than seven.

None of these is PAR’s own: the ceiling is plan/scope-policy.md’s, the gate is plan/policy.md’s, and the two stores are where the answer goes. This module calls them in the order below and decides nothing itself.

They are the whole of what judges a sign-in. There is no fourth seam and no second moment — see this module’s own doc. The assertion verifier judges nothing about the grant: it checks that a confidential client is who it says it is.

Fields

scope_policy: &'a dyn ScopePolicy

The ceiling this account may ever hold from this client.

consent_store: &'a dyn ConsentStore

Where the one-time reference an approval carries is minted.

decisions: &'a dyn DecisionStore

Where the record itself goes.

gate: &'a dyn PolicyGate

plan/policy.md’s deny-only gate, asked about the grant.

evaluation_log: &'a EvaluationLog

Where the ceiling’s narrowing or refusal is written down, payload-free. A policy’s refusal is written by DecisionSeams::gate itself, so this must be the same log that gate holds or the two halves of one deployment’s answer land in different places.

pds_did: &'a str

This deployment’s own DID, for the subject the gate judges.

pds_hostname: &'a str

This deployment’s own hostname, for the same subject.

loopback_clients: LoopbackClients

Whether this deployment fetches a loopback http:// client metadata document; see crate::oauth::client_metadata::LoopbackClients.

client_assertions: &'a ClientAssertionVerifier

Where a confidential client’s assertion is checked; see crate::oauth::client_auth.

issuer: &'a str

This deployment’s issuer, which a client assertion’s aud must name.

permission_sets: &'a PermissionSets

Where an include: scope’s permission set is resolved; see crate::oauth::permission_set.