| 104 | |
| 105 | #[allow(clippy::result_large_err, clippy::unused_self)] |
| 106 | fn check_scope(&self, identity: &Identity, method: &str) -> Result<(), Status> { |
| 107 | if identity.scopes.iter().any(|s| s == SCOPE_ALL) { |
| 108 | return Ok(()); |
| 109 | } |
| 110 | |
| 111 | let required_scope = method_authz::required_scope(method).unwrap_or(SCOPE_ALL); |
| 112 | |
| 113 | if identity.scopes.iter().any(|s| s == required_scope) { |
| 114 | return Ok(()); |
| 115 | } |
| 116 | |
| 117 | debug!( |
| 118 | sub = %identity.subject, |
| 119 | required_scope = required_scope, |
| 120 | user_scopes = ?identity.scopes, |
| 121 | method = method, |
| 122 | "authorization denied: missing scope" |
| 123 | ); |
| 124 | Err(Status::permission_denied(format!( |
| 125 | "scope '{required_scope}' required" |
| 126 | ))) |
| 127 | } |
| 128 | } |
| 129 | |
| 130 | #[cfg(test)] |