Function: scopeFromActor()

scopeFromActor<K>(actor, grant): MintedScope<K>

Defined in: packages/authz/src/mint.ts:106

THE one place a scope is minted from an actor. Importable by packages/messaging only (lint fence on @oktoid/authz/mint); a handler never calls it.

• A TenantActor yields a tenant Scope. It never needs evidence, and a grant passed with it is ignored: a platform grant does not widen a tenant actor.
• A PlatformActor yields a PlatformScope ONLY with grant; otherwise it throws. It can never yield a tenant Scope, so PLATFORM_ACTOR's / fails closed rather than matching every subtree.

packages/messaging verifies the signed actor token (slice 2 D2.2, with verifyActorToken, exported beside this function) BEFORE calling this, and this function trusts what it is given.

Type Parameters

K

K extends string = string

Parameters

actor

{ kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }

The verified envelope actor.

grant

PlatformGrant<K> | undefined

Evidence of a platform grant, from a caller that has checked it.

Returns

MintedScope<K>

The minted scope, tagged by kind.

Throws

Always a defect or an attack, never a normal denial: the receiver has already refused what it could.