Scopes

[johakoch]

• beta_scope_claim attribute for jwt block
  • JWT access control looks for scope values in claim named by beta_scope_claim
  • value of this claim must either be
    • a string containing a space-separated list of scope values or
    • a list of string scope values
  • scope values are stored in request.context.scopes as list of string
• beta_scope attribute for api and endpoint block to specify required scope
  • value must either be
    • a string (scope required to use all operations/methods on this api/endpoint) or
    • an object with operation/method as key and string value (scope required to use a specific operation/method on this api/endpoint)
      • operations/methods not listed are not permitted
      • key "*" meaning all other operations/methods
  • empty string ("") meaning no (additional) required scope

  api {
    access_control = [ "myjwt" ]
    endpoint "/contacts" {
      beta_scope = {
        get = "contacts:read"
        post = "contacts:create"
      }
      ...
    }
    endpoint "/contacts/{cid}" {
      beta_scope = {
        get = "contacts:read"
        patch = "contacts:update"
        delete = "contacts:delete"
      }
      ...
    }
  }
...
  jwt "myjwt" {
    ...
    beta_scope_claim = "scope"
  }

---

Reviewer checklist

• Read PR description: a summary about the changes is required
• Changelog updated
• Documentation: docs/{Reference, Cli, ...}, Docker and cli help/usage
• Pulled branch, manually tested
• Verified requirements are met
• Reviewed the code
• Reviewed the related tests