Package ai.vectros.types

Class ScopeClause

java.lang.Object
ai.vectros.types.ScopeClause
public final class ScopeClause extends Object

  • Method Details

    • getAllowedActions

      public List<String> getAllowedActions()
      Returns:
      Verbs this clause grants, in the compact 'resource:ops[:qualifier]' form the authorizer honors. 'ops' are the letters c/r/u/d (create/read/update/delete) plus 's' for sensitive-field REVEAL (PHI un-masking), e.g. 'records:cru', 'documents:r', 'records:rs:patient'. The 's' letter is fail-safe: absent it, sensitive fields are masked at the response boundary. The standard catalog is '*' (wildcard), 'keys:crd' (manage scoped API keys), 'profiles:cru' (manage access profiles), 'app-contexts:cru', 'logs:r', and the literal 'create_own_scoped_key'; you may add custom 'resource:ops' verbs for application-specific resources. Bare verbs like 'read'/'write'/'delete' are NOT grantable — use the resource:ops form. A ':qualifier' segment is honored only where it actually narrows the grant — 'records'/'entities' correlate it for every op; 'documents'/'users' correlate it ONLY for the 's' op (e.g. 'documents:s:invoice' restricts sensitive-field reveal to that type; a qualifier on 'documents:r' or any other resource/op combination is rejected rather than silently ignored).

    • getDataScope

      public Optional<Map<String,Map<String,Object>>> getDataScope()
      Returns:
      Attribute filters narrowing data this clause applies to, keyed per ownership dimension: 'userId' (the authoring principal) and namespaced scopes 'scope:<namespace>' ('scope:org', 'scope:client', 'scope:group', ...). Empty object = applies to ALL data within the tenant. Multiple keys must ALL match (AND); include null in an allowed-value list (e.g. {"scope:org": ["orgX", null]}) to ALSO grant access to records that have no value in THAT dimension.

    • equals

      public boolean equals(Object other)
      Overrides:
      equals in class Object

    • getAdditionalProperties

      public Map<String,Object> getAdditionalProperties()

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object

    • builder

      public static ScopeClause.Builder builder()