Method check

crates/openshell-server/src/auth/authz.rs:66–103

(&self, identity: &Identity, method: &str)

    /// (authentication-only mode for providers like GitHub).
    #[allow(clippy::result_large_err)]
    pub fn check(&self, identity: &Identity, method: &str) -> Result<(), Status> {
        let required = match method_authz::required_role(method) {
            Some(Role::Admin) => &self.admin_role,
            // Default to user role for unknown methods, matching the
            // pre-annotation behavior. The exhaustiveness test ensures
            // every real RPC has an explicit declaration.
            Some(Role::User) | None => &self.user_role,
        };

        // Empty role name = skip role check for this level (auth-only mode).
        // Scope enforcement still applies if enabled.
        if !required.is_empty() {
            // Admin role implicitly satisfies user role requirements.
            let has_role = identity.roles.iter().any(|r| r == required)
                || (!self.admin_role.is_empty()
                    && required == &self.user_role
                    && identity.roles.iter().any(|r| r == &self.admin_role));

            if !has_role {
                debug!(
                    sub = %identity.subject,
                    required_role = required,
                    user_roles = ?identity.roles,
                    method = method,
                    "authorization denied: missing role"
                );
                return Err(Status::permission_denied(format!(
                    "role '{required}' required"
                )));
            }
        }

        if self.scopes_enabled {
            self.check_scope(identity, method)?;
        }

        Ok(())
    }

    #[allow(clippy::result_large_err, clippy::unused_self)]
    fn check_scope(&self, identity: &Identity, method: &str) -> Result<(), Status> {