Use this plug to ensure that there are the correct permissions set in the claims found on the connection.

Example

alias Guardian.Plug.EnsurePermissions

# read and write permissions for the admin set
plug EnsurePermissions, admin: [:read, :write], handler: SomeMod,

# read AND write permissions for the admin set
# AND :profile for the default set
plug EnsurePermissions, admin: [:read, :write],
                        default: [:profile],
                        handler: SomeMod

# read AND write permissions for the admin set
# OR :profile for the default set
plug EnsurePermissions, one_of: [%{admin: [:read, :write]},
                        %{default: [:profile]}],
                        handler: SomeMod

# admin :read AND :write for the claims located in the :secret location
plug EnsurePermissions, key: :secret,
                        admin: [:read, :write],
                        handler:SomeMod

On failure will be handed the connection with the conn, and params where reason: :forbidden

The handler will be called on failure. The :unauthorized function will be called when a failure is detected.