Liking cljdoc? Tell your friends :D

scopula.core

Handles scopes logic.

Scopes are case-sensitive strings without any whitespace, that represent authorization access. From OAuth2 RFC (https://tools.ietf.org/html/rfc6749#section-3.3):

The value of the scope parameter is expressed as a list of space- delimited, case-sensitive strings. The strings are defined by the authorization server. If the value contains multiple space-delimited strings, their order does not matter, and each string adds an additional access range to the requested scope.

scope = scope-token ( SP scope-token ) scope-token = 1( %x21 / %x23-5B / %x5D-7E )

In order to manage fine-grained authorizations, this lib uses a convention for scope formats. For example, we often need to distinguish between a full scope that will provides full access to some resource, and read-only access. Sometimes we also want to limit the access to some sub-resource. Here are some examples of our convention:

users full access to users resource users/profile access to users profile only users/profile:read access to users profile read-only users/profile/email:write access to users profile only email write-only

Mainly : is only authorized to split between access read/write/rw (nothing implies rw).

Sub-resources can be separated by /.

This library provides helper functions to check that a given scope will also grant e.g. users/profile/email and users/profile:read.

We also provide helpers to normalize sets of scopes:

(normalize-scopes #{"users" "users/profile/email:read" "admin"}) #{"users" "admin"}

...as users/profile/email:read is redundant, it is removed.

Note that scopes are meant to be used in an OAuth2 access in mind, and thus are generally manipulated as a set of scopes.

scopes that do not have any subpath are called root scopes.

This is important because it is easy to add, union scopes. But it is generally impossible to remove just a sub-scope as it would mean we should know all the sub-paths of some root-scope and add the difference.

Scope are additive by nature.

Handles scopes logic.

Scopes are case-sensitive strings without any whitespace, that represent
authorization access. From OAuth2 RFC (https://tools.ietf.org/html/rfc6749#section-3.3):

> The value of the scope parameter is expressed as a list of space-
> delimited, case-sensitive strings.  The strings are defined by the
> authorization server.  If the value contains multiple space-delimited
> strings, their order does not matter, and each string adds an
> additional access range to the requested scope.
>
>   scope       = scope-token *( SP scope-token )
>   scope-token = 1*( %x21 / %x23-5B / %x5D-7E )

In order to manage fine-grained authorizations, this lib uses a convention
for scope formats.
For example, we often need to distinguish between a full scope that will provides
full access to some resource, and read-only access.
Sometimes we also want to limit the access to some sub-resource.
Here are some examples of our convention:

`users`                      full access to users resource
`users/profile`              access to users profile only
`users/profile:read`         access to users profile read-only
`users/profile/email:write`  access to users profile only email write-only

Mainly `:` is only authorized to split between access read/write/rw
(nothing implies rw).

Sub-resources can be separated by `/`.

This library provides helper functions to check that
a given scope will also grant e.g. `users/profile/email` and `users/profile:read`.

We also provide helpers to normalize sets of scopes:

>>> (normalize-scopes #{"users" "users/profile/email:read" "admin"})
#{"users" "admin"}

...as `users/profile/email:read` is redundant, it is removed.

Note that scopes are meant to be used in an OAuth2 access in mind, and thus
are generally manipulated as a set of scopes.

scopes that do not have any subpath are called _root scopes_.

This is important because it is easy to add, union scopes.
But it is generally impossible to remove just a sub-scope as it would
mean we should know all the sub-paths of some root-scope and add the difference.

Scope are additive by nature.
raw docstring

cljdoc is a website building & hosting documentation for Clojure/Script libraries

× close