Method effective_scopes

nodedb/src/control/security/scope/grant.rs:266–285

Resolve effective scopes for a user. Collects: user's direct scopes + org scopes for each org membership. Filters out expired grants.

(&self, user_id: &str, org_ids: &[String])

    /// Collects: user's direct scopes + org scopes for each org membership.
    /// Filters out expired grants.
    pub fn effective_scopes(&self, user_id: &str, org_ids: &[String]) -> HashSet<String> {
        let grants = self.grants.read().unwrap_or_else(|p| p.into_inner());
        let mut effective = HashSet::new();

        for g in grants.values() {
            if !g.is_effective() {
                continue; // Skip expired grants.
            }
            // Direct user grant.
            if g.grantee_type == "user" && g.grantee_id == user_id {
                effective.insert(g.scope_name.clone());
            }
            // Org grant (user inherits via membership).
            if g.grantee_type == "org" && org_ids.contains(&g.grantee_id) {
                effective.insert(g.scope_name.clone());
            }
        }

        effective
    }

    /// Check if a user (directly or via orgs) has a specific scope.
    pub fn has_scope(&self, user_id: &str, org_ids: &[String], scope_name: &str) -> bool {