guide reproducing JWT scope with attenuation

[Geal]

this will have to wait until the website is updated with the new biscuit version supporting check all

[divarvel]

Even with check all, I think there is an issue: the example provided requires reading facts from attenuation blocks, something which is not possible (by design) in the authorizer.

Another solution would be to use the regular attenuation mechanism: a check if in the block. The required modification would be on the authorizer side: it would need to provide a request_scope fact describing the scope required by the request.

// authority
scope(["read:article", "write:article", "read:comment", "write:comment"]);

// block 1
check if request_scope($scope), ["read:comment", "write:comment"].contains($scope);

// authorizer
request_scope("read:comment");
allow if request_scope($scope), scope($scopes), $scopes.contain($scope);