RequestSeal.Ash.Scope (RequestSeal v0.2.0)

Caller-bound actor, tenant, and bounded verification context for Ash actions.

Construct with RequestSeal.Ash.scope/2. principal is a classification only; the opaque identity value stays in caller-selected actor/tenant values. Default inspection exposes only principal and authorize?.

to_opts/1 works without Ash installed. When Ash is present at compilation, the guarded Ash.Scope.ToOpts implementation also enables scope: scope. When adding Ash to a consumer that already compiled RequestSeal without it, run mix deps.compile request_seal --force to compile the protocol implementation.

Summary

Types

t()

Functions

to_opts(scope)

Returns explicit actor, tenant, context, and authorize?: true options.

Types

t()

@type t() :: %RequestSeal.Ash.Scope{
  actor: term() | nil,
  authorize?: true,
  context: %{
    request_seal: %{
      label: binary(),
      profile: %{name: :rfc9421} | %{name: :web_bot_auth, revision: binary()},
      principal: :attributed | :unattributed,
      covered: [binary()],
      content: :not_required | :checked,
      freshness: :not_evaluated | :evaluated,
      replay: :not_required
    }
  },
  principal: :attributed | :unattributed,
  tenant: term() | nil
}

Functions

to_opts(scope)

@spec to_opts(t()) :: keyword()

Returns explicit actor, tenant, context, and authorize?: true options.