Package ai.vectros.types

Interface RoleRequest._FinalStage

All Known Implementing Classes:
RoleRequest.Builder
Enclosing class:
RoleRequest
public static interface RoleRequest._FinalStage

  • Method Details

    • build

      RoleRequest build()

    • additionalProperty

      RoleRequest._FinalStage additionalProperty(String key, Object value)

    • additionalProperties

      RoleRequest._FinalStage additionalProperties(Map<String,Object> additionalProperties)

    • description

      RoleRequest._FinalStage description(Optional<String> description)

      An optional free-text description of what the role grants.

    • description

      RoleRequest._FinalStage description(String description)

    • scopes

      RoleRequest._FinalStage scopes(List<ScopeClause> scopes)

      The role's permissions, as one or more scope clauses. Each clause has allowed_actions (a list of permitted verbs), data_scope (an attribute filter that restricts which records the actions apply to), and an optional granted_capabilities list. An action is permitted if any clause allows that action and that clause's data scope matches the target record — with one caveat worth knowing before you use granted_capabilities: a clause naming a capability this release does not recognize is denied ENTIRELY, so its allowed_actions stop applying too. To include records whose ownership field is null (account-level shared records), add null to the allowed values for that field. One exception applies when creating an identity entity: the entity's own-namespace dimension (scope:<namespace>) takes the value of the ID the server is about to generate, so no clause written beforehand could name it, and that one dimension is exempt from the match on POST /v1/entities/{namespace}. It is matched normally on every read, update, and delete — so a clause whose data scope names only that dimension does not restrict what you may create, and an entity created under one may fall outside it once it exists.

    • addScopes

      RoleRequest._FinalStage addScopes(ScopeClause scopes)

    • addAllScopes

      RoleRequest._FinalStage addAllScopes(List<ScopeClause> scopes)

    • assumable

      RoleRequest._FinalStage assumable(Optional<Map<String,Object>> assumable)

      The POST /v1/auth/token/assume entitlement grant: which values, per scope:<namespace>, a holder of THIS role may assume via /assume. Role-level (unlike data_scope, which is per-clause) — this is a deliberately separate question from what scopes permits reading or writing; holding broad data_scope reach in a namespace does NOT by itself grant assuming any value in it. The principal (userId) can never be named — it is never assumable. Each value list accepts a plain literal, ${{ under.self.userId }}, or ${{ member.scope.<namespace>[:level] }} — never ${{ under.self.scope.<namespace> }} (it resolves against the caller's CURRENT value for a namespace /assume can itself change, so what it admitted would depend on what was last assumed; that form stays valid in data_scope, where it's re-derived per write), a bare ${{ self.<dim> }}, or ${{ any }}, all rejected at authoring time. Omitting the field grants no assumption of anything, the safe default.

    • assumable

      RoleRequest._FinalStage assumable(Map<String,Object> assumable)