Method extract_scopes

crates/openshell-server/src/auth/oidc.rs:142–164

Extract scopes from the JWT claims using a dot-separated path. Handles two formats: - Space-delimited string: `"openid sandbox:read sandbox:write"` (Keycloak, Entra) - JSON array: `["sandbox:read", "sandbox:write"]` (Okta) Filters out standard OIDC scopes (`openid`, `profile`, `email`, `offline_access`).

(&self, scopes_claim: &str)

    ///
    /// Filters out standard OIDC scopes (`openid`, `profile`, `email`, `offline_access`).
    fn extract_scopes(&self, scopes_claim: &str) -> Vec<String> {
        let mut value = &self.extra;
        for segment in scopes_claim.split('.') {
            match value.get(segment) {
                Some(v) => value = v,
                None => return vec![],
            }
        }

        let raw: Vec<String> = if let Some(s) = value.as_str() {
            s.split_whitespace().map(String::from).collect()
        } else if let Some(arr) = value.as_array() {
            arr.iter()
                .filter_map(|v| v.as_str().map(String::from))
                .collect()
        } else {
            return vec![];
        };

        raw.into_iter()
            .filter(|s| !STANDARD_OIDC_SCOPES.contains(&s.as_str()))
            .collect()
    }
}

impl JwksCache {