Skip to main content

resolve_gated_bearer_allowed

headless_lms_server::controllers::main_frontend::oauth::introspect

Function resolve_gated_bearer_allowed 

Source 
fn resolve_gated_bearer_allowed(
    introspecting_client: &OAuthClient,
    token_client: &OAuthClient,
) -> Option<bool>
Expand description

Resolve the client_bearer_allowed member of the introspection response — a privileged, non-standard member letting resource servers apply the same bearer_allowed = false rejection domain::exercise_services::token applies here.

Reports the issuing client (token_client), never the introspecting caller. Gated like upstream_id: disclosed only to a confidential caller, and omitted rather than serialized as false otherwise, so a false is never ambiguous between “not permitted” and “not disclosed”. See IntrospectResponse::client_bearer_allowed for the fail-closed contract.