Struct AuthContext 

pub struct AuthContext {
    subject: Option<String>,
    scopes: HashSet<String>,
    is_local: bool,
    org_name: Option<String>,
    org_role: Option<String>,
    group_roles: HashMap<String, String>,
}

Authorization context for service operations.

Carries identity and permission information through the service layer. Can be created from JWT claims or constructed directly for testing.

Fields

subject: Option<String>

Subject identifier (user ID, service account, etc.).

scopes: HashSet<String>

Granted scopes/permissions.

is_local: bool

Whether this is a local/CLI context (implicitly trusted).

org_name: Option<String>

Organization name (for org-scoped operations).

org_role: Option<String>

Role within the organization (admin, member, etc.).

group_roles: HashMap<String, String>

Group roles (group_id → role string).

Implementations

impl AuthContext

pub fn local() -> Self

Creates a local context with full permissions.

Used for CLI access where the user has local filesystem access.

pub fn from_scopes(scopes: Vec<String>) -> Self

Creates a context from a list of scope strings.

Arguments

• scopes - List of scope strings (e.g., ["read", "write"]).

pub fn builder() -> AuthContextBuilder

Creates a builder for constructing an auth context.

pub fn with_subject(self, subject: impl Into<String>) -> Self

Sets the subject identifier.

pub fn subject(&self) -> Option<&str>

Returns the subject identifier.

pub const fn is_local(&self) -> bool

Returns whether this is a local/CLI context.

pub fn org_name(&self) -> Option<&str>

Returns the organization name if set.

pub fn org_role(&self) -> Option<&str>

Returns the organization role if set.

pub fn has_org_access(&self) -> bool

Returns whether this context has org access.

pub fn has_scope(&self, scope: &str) -> bool

Checks if the context has a specific scope.

pub fn has_permission(&self, permission: Permission) -> bool

Checks if the context has a specific permission.

pub fn has_any_permission(&self, permissions: &[Permission]) -> bool

Checks if the context has any of the specified permissions.

pub fn require(&self, permission: Permission) -> Result<()>

Requires a specific permission, returning an error if not granted.

Errors

Returns Error::Unauthorized if the permission is not granted.

pub fn require_any(&self, permissions: &[Permission]) -> Result<()>

Requires any of the specified permissions.

Errors

Returns Error::Unauthorized if none of the permissions are granted.

pub fn get_group_role(&self, group_id: &str) -> Option<GroupRole>

Returns the user’s role in a specific group.

Arguments

• group_id - The group identifier.

Returns

Some(GroupRole) if the user has a role in the group, None otherwise. For local contexts, always returns Some(GroupRole::Admin).

pub fn has_group_permission(&self, group_id: &str, min_role: GroupRole) -> bool

Checks if the user has at least the specified role in a group.

Arguments

• group_id - The group identifier.
• min_role - The minimum required role.

Returns

true if the user has sufficient permissions, false otherwise.

pub fn require_group_role( &self, group_id: &str, min_role: GroupRole, ) -> Result<()>

Requires at least the specified role in a group.

Arguments

• group_id - The group identifier.
• min_role - The minimum required role.

Errors

Returns Error::Unauthorized if the user doesn’t have the required role.

Trait Implementations

impl Clone for AuthContext

fn clone(&self) -> AuthContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthContext

fn default() -> Self

Creates a default context that allows all operations.

This is used for CLI/local access where there’s no authentication.