Package ai.vectros.types

Class RoleRequest

java.lang.Object
ai.vectros.types.RoleRequest
public final class RoleRequest extends Object

  • Method Details

    • getRoleId

      public String getRoleId()
      Returns:
      Your own identifier for the role. Must be 3 to 31 characters, starting with a lowercase letter and containing only lowercase letters, digits, and dashes (the same rules as a context ID). Required when creating a role; ignored when updating, since the role ID is taken from the URL path.

    • getName

      public String getName()
      Returns:
      A human-readable display name for the role.

    • getDescription

      public Optional<String> getDescription()
      Returns:
      An optional free-text description of what the role grants.

    • getScopes

      public List<ScopeClause> getScopes()
      Returns:
      The role's permissions, as one or more scope clauses. Each clause has allowed_actions (a list of permitted verbs), data_scope (an attribute filter that restricts which records the actions apply to), and an optional granted_capabilities list. An action is permitted if any clause allows that action and that clause's data scope matches the target record — with one caveat worth knowing before you use granted_capabilities: a clause naming a capability this release does not recognize is denied ENTIRELY, so its allowed_actions stop applying too. To include records whose ownership field is null (account-level shared records), add null to the allowed values for that field. One exception applies when creating an identity entity: the entity's own-namespace dimension (scope:<namespace>) takes the value of the ID the server is about to generate, so no clause written beforehand could name it, and that one dimension is exempt from the match on POST /v1/entities/{namespace}. It is matched normally on every read, update, and delete — so a clause whose data scope names only that dimension does not restrict what you may create, and an entity created under one may fall outside it once it exists.

    • getAssumable

      public Optional<Map<String,Object>> getAssumable()
      Returns:
      The POST /v1/auth/token/assume entitlement grant: which values, per scope:<namespace>, a holder of THIS role may assume via /assume. Role-level (unlike data_scope, which is per-clause) — this is a deliberately separate question from what scopes permits reading or writing; holding broad data_scope reach in a namespace does NOT by itself grant assuming any value in it. The principal (userId) can never be named — it is never assumable. Each value list accepts a plain literal, ${{ under.self.userId }}, or ${{ member.scope.<namespace>[:level] }} — never ${{ under.self.scope.<namespace> }} (it resolves against the caller's CURRENT value for a namespace /assume can itself change, so what it admitted would depend on what was last assumed; that form stays valid in data_scope, where it's re-derived per write), a bare ${{ self.<dim> }}, or ${{ any }}, all rejected at authoring time. Omitting the field grants no assumption of anything, the safe default.

    • equals

      public boolean equals(Object other)
      Overrides:
      equals in class Object

    • getAdditionalProperties

      public Map<String,Object> getAdditionalProperties()

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object

    • builder

      public static RoleRequest.RoleIdStage builder()