Package ai.vectros.types

Class ScopeClause

java.lang.Object
ai.vectros.types.ScopeClause
public final class ScopeClause extends Object

  • Method Details

    • getAllowedActions

      public List<String> getAllowedActions()
      Returns:
      Verbs this clause grants, in the compact 'resource:ops[:qualifier]' form the authorizer honors. 'ops' are the letters c/r/u/d (create/read/update/delete) plus 's' for sensitive-field REVEAL (PHI un-masking), e.g. 'records:cru', 'documents:r', 'records:rs:patient'. The 's' letter is fail-safe: absent it, sensitive fields are masked at the response boundary. The standard catalog is '*' (wildcard), 'keys:crd' (manage scoped API keys), 'profiles:cru' (manage access profiles), 'app-contexts:cru', 'users:crud' (manage your tenant's own users, including sub-user invitations), 'logs:r', and the literal 'create_own_scoped_key'; you may add custom 'resource:ops' verbs for application-specific resources. Bare verbs like 'read'/'write'/'delete' are NOT grantable — use the resource:ops form. A ':qualifier' segment is honored only where it actually narrows the grant — 'records'/'entities' correlate it for every op; 'documents'/'users' correlate it ONLY for the 's' op (e.g. 'documents:s:invoice' restricts sensitive-field reveal to that type; a qualifier on 'documents:r' or any other resource/op combination is rejected rather than silently ignored).

    • getDataScope

      public Optional<Map<String,Map<String,Object>>> getDataScope()
      Returns:
      Attribute filters narrowing the data this clause applies to, keyed per ownership dimension: 'userId' (the owning user) and namespaced scopes 'scope:<namespace>' ('scope:org', 'scope:client', 'scope:group', ...). Use '*' as the key to state a rule for every dimension this clause does not name explicitly; a named dimension always takes precedence over it. Multiple keys must ALL match (AND).

      Allowed values are ids, plus: null — records with NO value in that dimension (e.g. {"scope:org": ["orgX", null]} means orgX's records AND unowned ones); '${{ any }}' — any value in that dimension, but NOT records lacking one, so combine it with null to cover both; '${{ self.userId }}' / '${{ self.scope.<namespace> }}' — the credential's own value, resolved per request; '${{ under.self.userId }}' / '${{ under.self.scope.<namespace> }}' — values whose immediate parent is the credential's own (one level, not a full ancestor walk). Any other '${{ ... }}' spelling is rejected.

      Reads and writes differ where a dimension is OMITTED: reading is not narrowed by a dimension the clause says nothing about, but writing a value into that dimension is not authorized by silence — a clause must name a dimension (or '*') to place data there. An empty object therefore reads tenant-wide and authorizes no placement.

    • equals

      public boolean equals(Object other)
      Overrides:
      equals in class Object

    • getAdditionalProperties

      public Map<String,Object> getAdditionalProperties()

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object

    • builder

      public static ScopeClause.Builder builder()