Mirrors ResolverBase.CheckAPIKeyScopeAuthorization (packages/MJServer/src/generic/ResolverBase.ts), which is
protected on the resolver base and so cannot be called from an Express route:
rules are evaluated and usage is logged as the SYSTEM user — the API key's user may not be able to read scope
rules or write usage logs;
the full_access scope short-circuits the specific check (evaluated with skipLogging: it is a fast path,
not the authorization decision);
the session user's acting context is passed so filtered rules with {{Acting*}} tokens do not fail closed.
Callers without an API key never reach this class: the handler refuses them first (03 §9).
Mirrors ResolverBase.CheckAPIKeyScopeAuthorization (packages/MJServer/src/generic/ResolverBase.ts), which is protected on the resolver base and so cannot be called from an Express route:
full_accessscope short-circuits the specific check (evaluated with skipLogging: it is a fast path, not the authorization decision);