adk_scope_authorizer (erlang_adk v0.7.0)

View Source

Default-deny OIDC scope authorizer for production ADK gateways.

The principal is re-derived from issuer and subject using the same binding as adk_jwt_policy. This makes a malformed or accidentally hand-built identity fail closed before it can select a user/session scope.

Summary

Functions

authorize(Policy, Identity, Action, Resource)
new(Config)
owner_scope(Issuer, Subject)

Functions

authorize(Policy, Identity, Action, Resource)

-spec authorize(map(), adk_authorizer:identity(), adk_authorizer:action(), adk_authorizer:resource()) ->
                   {ok, adk_authorizer:decision()} | {error, unauthenticated | forbidden}.

new(Config)

-spec new(map()) -> {ok, map()} | {error, invalid_policy}.

owner_scope(Issuer, Subject)

-spec owner_scope(binary(), binary()) -> binary().