fn asScoped

Runs body with a narrower caller (§13.2): the calls it makes carry p - a user with fewer roles (ctx.caller.scoped([...])) instead of the original principal. Only the runtime's own metadata carries it: a downstream node trusts it because the call arrives over mTLS from a cluster node. Claims are dropped.

Example:

use std.rpc { asScoped }

fn run() io {
  // calls made inside carry a user with only the `reader` role
  let narrowed = Principal.User(id: "u1", roles: ["reader"], mfa: false, tenant: none, claims: {:})
  asScoped(narrowed) { print("scoped") }
}

pub(api) fn asScoped<T, effect F>(p: Principal, body: fn() -> T F) -> T  F

Since. 1.0.0-beta

Parameters

Returns

T F

Effects

none declared (pure unless the body says otherwise)

Defined in: std/rpc/rpc.oxl:307