Package ai.vectros.types

Class ScopeRequest.Builder

java.lang.Object
ai.vectros.types.ScopeRequest.Builder
Enclosing class:
ScopeRequest
public static final class ScopeRequest.Builder extends Object

  • Method Details

    • from

      public ScopeRequest.Builder from(ScopeRequest other)

    • allowedActions

      public ScopeRequest.Builder allowedActions(Optional<List<String>> allowedActions)

      The actions this token may perform. Each entry has the form resource:operations, where operations is one of r (read), c (create), u (update), d (delete), crud (all four), or a colon-separated combination. For records you may append a type qualifier, e.g. records:r:intake_form. For identity entities the grammar is entities:<verb>:<namespace>, e.g. entities:r:org or entities:c:client (reserved namespaces org and client). Valid resources are: entities, users, documents, folders, records, schemas, and search. namespaces is deliberately not among them: reading the namespace registry is open to any credential, and registering, updating, or deleting a namespace requires a root API key — so a namespaces:<verb> entry would neither grant nor withhold anything.

    • allowedActions

      public ScopeRequest.Builder allowedActions(List<String> allowedActions)

    • identity

      public ScopeRequest.Builder identity(Optional<Map<String,String>> identity)

      Default ownership values stamped onto resources created with this token. Optional. Keys are ownership dimensions: userId, or any scope namespace in canonical scope:<namespace> form (e.g. scope:org, scope:client, scope:group). Entity values must be Vectros UUIDs — look them up with GET /v1/users or GET /v1/entities/{namespace}; custom-scope values are identifiers you define, of 1-128 characters: a letter or digit first, then letters, digits, _ or -. These are the values used when a create does not state its own, and the values ${{ self.* }} resolves to inside data_scope. They may be narrowed per create via the scopes request field. Identity does NOT bound what this token may stamp — data_scope does. To confine a token to its own value in a dimension, name that dimension in data_scope as ${{ self.scope.<namespace> }}.

    • identity

      public ScopeRequest.Builder identity(Map<String,String> identity)

    • dataScope

      public ScopeRequest.Builder dataScope(Optional<Map<String,List<String>>> dataScope)

      Restricts which records the token can access, and authorizes where it may place them. Optional. Keys are ownership dimensions: userId, or any scope namespace in canonical scope:<namespace> form (e.g. scope:org, scope:client, scope:group); values are arrays of permitted values — the token can only access records whose dimension matches one of these values. Use * as the key to state a rule for every dimension not named explicitly; a named dimension always takes precedence over it. Every non-null entity UUID must be a real entity in your account, and each dimension may be named only once. Include a JSON null in the array (e.g. ["uuid", null]) to ALSO match records with no value in THAT dimension — an explicit per-dimension sentinel, NOT a wildcard. ${{ any }} matches any value in the dimension but NOT records lacking one, so combine it with null to cover both; ${{ self.userId }} / ${{ self.scope.<namespace> }} resolve to the credential's own value per request; ${{ under.self.userId }} / ${{ under.self.scope.<namespace> }} match values whose immediate parent is the credential's own. Reads and writes differ where a dimension is OMITTED: reading is not narrowed by a dimension the data scope says nothing about, but writing a value into that dimension is not authorized by silence — name the dimension (or *) to place data there. An empty object therefore reads tenant-wide and authorizes no placement.

    • dataScope

      public ScopeRequest.Builder dataScope(Map<String,List<String>> dataScope)

    • build

      public ScopeRequest build()

    • additionalProperty

      public ScopeRequest.Builder additionalProperty(String key, Object value)

    • additionalProperties

      public ScopeRequest.Builder additionalProperties(Map<String,Object> additionalProperties)