Authorization evaluation with key and user status

[sanjay-saxena]

Description

From the SDD:

The evaluation endpoint sets result.allowed to true only when all of the following conditions are satisfied:
The key status is ACTIVE.
The current time is before expiresAt.
The account-scoped user status is ACTIVE.
The service-specific user status is absent or ACTIVE.
The requested audience is registered, and the stored authorization data permits the request.

An account-scoped SUSPENDED status overrides a service-specific ACTIVE status. A service-specific SUSPENDED status denies only keys issued by that service in that NCA. User status is evaluated independently of key status, so an ACTIVE key can still produce allowed: false.

Definition of Done

• Use key status, user's account-scoped status, and user's service-specific status to evaluate authz
• Implement tests with various combinations of statuses

---

By submitting this issue, you acknowledge that you are an assigned member of the NVCF development team and agree to follow our code of conduct and our contributing guidelines.