Struct ToolAuthorization 

pub struct ToolAuthorization {
    pub allow_unknown_with_admin: bool,
}

Tool authorization configuration (CRIT-003).

Maps tool names to required scopes for fine-grained access control. Unknown tools are explicitly denied by returning None from required_scope.

Fields

allow_unknown_with_admin: bool

Whether to allow unknown tools with admin scope (default: false, deny unknown).

Implementations

impl ToolAuthorization

const KNOWN_TOOLS: &'static [(&'static str, &'static str)]

Known tools and their scopes (compile-time constant for security).

pub fn required_scope(&self, tool_name: &str) -> Option<&'static str>

Returns the required scope for a tool, or None if the tool is unknown.

Security

Unknown tools return None to enforce explicit denial by default. This prevents authorization bypass via unrecognized tool names.

Tool scope mapping:

• subcog_capture, subcog_enrich, subcog_consolidate: “write”
• subcog_recall, subcog_status, subcog_namespaces, prompt_understanding: “read”
• subcog_sync, subcog_reindex: “admin”
• prompt_save, prompt_delete: “write”
• prompt_list, prompt_get, prompt_run: “read”
• Unknown tools: None (explicit deny) or “admin” if allow_unknown_with_admin

pub fn is_known_tool(tool_name: &str) -> bool

Checks if a tool name is known to the authorization system.

This is part of the public API for callers to verify tool names before making authorization requests.

pub fn is_authorized(&self, claims: &Claims, tool_name: &str) -> bool

Checks if claims authorize access to a tool.

Arguments

• claims - The JWT claims to check.
• tool_name - The name of the tool being called.

Returns

true if the tool is known and claims include the required scope. Returns false for unknown tools (explicit deny).

Trait Implementations

impl Clone for ToolAuthorization

fn clone(&self) -> ToolAuthorization

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ToolAuthorization

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ToolAuthorization

fn default() -> ToolAuthorization

Returns the “default value” for a type.