def check_scopes(required_scopes, scopes):
    """Check that required_scope(s) are in scopes

    Returns the subset of scopes matching required_scopes,
    which is truthy if any scopes match any required scopes.

    Correctly resolves scope filters *except* for groups -> user,
    e.g. require: access:server!user=x, have: access:server!group=y
    will not grant access to user x even if user x is in group y.

    Parameters
    ----------

    required_scopes: set
        The set of scopes required.
    scopes: set
        The set (or list) of scopes to check against required_scopes

    Returns
    -------
    relevant_scopes: set
        The set of scopes in required_scopes that are present in scopes,
        which is truthy if any required scopes are present,
        and falsy otherwise.
    """
    if isinstance(required_scopes, str):
        required_scopes = {required_scopes}

    intersection = _intersect_expanded_scopes(required_scopes, scopes)
    # re-intersect with required_scopes in case the intersection
    # applies stricter filters than required_scopes declares
    # e.g. required_scopes = {'read:users'} and intersection has only {'read:users!user=x'}
    return set(required_scopes) & intersection
Check that required_scope(s) are in scopes

Returns the subset of scopes matching required_scopes,
which is truthy if any scopes match any required scopes.

Correctly resolves scope filters *except* for groups -> user,
e.g. require: access:server!user=x, have: access:server!group=y
will not grant access to user x even if user x is in group y.

Parameters
----------

required_scopes: set
The set of scopes required.
scopes: set
The set (or list) of scopes to check against required_scopes

Returns
-------
relevant_scopes: set
The set of scopes in required_scopes that are present in scopes,
which is truthy if any required scopes are present,
and falsy otherwise.
jupyterhub/services/auth.py