ExScim.Authorization.Adapter behaviour (ex_scim v0.3.0)

Implements an authorization policy and decides whether an authenticated ExScim.Scope may perform an action on a resource.

Summary

action()

denial()

Indicate missing scopes or other reason for denying access.

resource()

Returns :ok when scope may perform action on resource, {:error, denial} otherwise.

@type action() :: :read | :create | :update | :delete

@type denial() :: {:missing_scopes, [String.t()]} | term()

Indicate missing scopes or other reason for denying access.

@type resource() ::
  :users | :groups | :me | :schemas | :resource_types | :service_provider_config

@callback authorize(scope :: ExScim.Scope.t(), resource(), action()) ::
  :ok | {:error, denial()}

Returns :ok when scope may perform action on resource, {:error, denial} otherwise.