انتقل إلى المحتوى الرئيسي

Interface: Scope

Defined in: packages/authz/src/scope.ts:15

The authority to act inside one subtree: the actor, and the subtree they may reach.

It cannot be written as a literal (the brand is a non-exported unique symbol) and the only constructor is scopeFromActor in @oktoid/authz/mint, which only packages/messaging may import. A handler receives one and passes it down. Distinct from PlatformScope: neither is assignable to the other.

Properties​

[tenantScopeBrand]​

readonly [tenantScopeBrand]: true

Defined in: packages/authz/src/scope.ts:16

path​

readonly path: TreePath

Defined in: packages/authz/src/scope.ts:20

The subtree they may reach, never /.

roles​

readonly roles: readonly ("subject.create" | "subject.read" | "person.create" | "person.read" | "grant.create" | "grant.read" | "grant.revoke" | "accreditation.apply" | "accreditation.admit" | "accreditation.publish" | "accreditation.read" | "entity-statement.read" | "identifier.create" | "identifier.read" | "identifier.publish" | "identifier.update")[]

Defined in: packages/authz/src/scope.ts:27

What the actor's grant lets them do inside path: the bundle's permissions (slice 1 D1.8). Check one with hasPermission, never by reading a provider claim.

subjectId​

readonly subjectId: string

Defined in: packages/authz/src/scope.ts:18

Who is acting.

tenant​

readonly tenant: string

Defined in: packages/authz/src/scope.ts:22

The organization at the root of the path.