confium_pki/delegation/
scope.rs

1//! Delegation scope — what a child cert is authorized to do.
2
3use crate::delegation::constraint::Constraint;
4use crate::delegation::operation::Operation;
5use serde::{Deserialize, Serialize};
6
7/// The full scope of a delegated authority.
8#[derive(Debug, Clone, Default, Serialize, Deserialize)]
9pub struct DelegationScope {
10    /// Operations the child is authorized to perform.
11    pub allowed_operations: Vec<Operation>,
12    /// Constraints that further narrow authorization.
13    pub constraints: Vec<Constraint>,
14}
15
16impl DelegationScope {
17    /// Construct a new empty scope.
18    pub fn new() -> Self {
19        Self::default()
20    }
21
22    /// Add an operation.
23    pub fn allow_operation(mut self, op: Operation) -> Self {
24        self.allowed_operations.push(op);
25        self
26    }
27
28    /// Add a constraint.
29    pub fn constrain(mut self, c: Constraint) -> Self {
30        self.constraints.push(c);
31        self
32    }
33}
confium_pki/delegation/scope.rs

confium_pki/delegation/
scope.rs
