tegwick
56940727bf
Close the remaining PDP obligations: mechanical layer declaration check, registry-snapshot digest in provenance, explicit allow TTL, per-input-class freshness deadlines, and the published decision-record contract. Document the canonical request digest as the §6.4.2 replay test. Assistant: grok Assistant-Session: 01a06256-fb71-7102-b3a9-27e6734257d0
86 lines
3.3 KiB
JSON
86 lines
3.3 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://flex-auth.netkingdom/schemas/policy_package.schema.json",
|
|
"title": "PolicyPackageMetadata",
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": ["id", "version", "package", "caring"],
|
|
"properties": {
|
|
"id": {"type": "string", "minLength": 1},
|
|
"name": {"type": "string", "minLength": 1},
|
|
"namespace": {"type": "string", "minLength": 1},
|
|
"version": {"type": "string", "minLength": 1},
|
|
"status": {"type": "string", "minLength": 1},
|
|
"package": {"type": "string", "minLength": 1},
|
|
"actions": {
|
|
"type": "array",
|
|
"items": {"type": "string", "minLength": 1},
|
|
"uniqueItems": true
|
|
},
|
|
"owner": {"type": "string", "minLength": 1},
|
|
"fixtures": {
|
|
"type": "array",
|
|
"items": {"type": "string", "minLength": 1},
|
|
"uniqueItems": true
|
|
},
|
|
"caring": {"$ref": "#/$defs/caring_policy_metadata"},
|
|
"activation": {"type": "object", "additionalProperties": true},
|
|
"metadata": {"type": "object", "additionalProperties": true},
|
|
"allow_ttl": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"description": "Go duration bounding every allow this package produces (e.g. 15m). Omit to use the engine default of 15m. The values none and 0s mean no stated end; the engine denies those allows."
|
|
}
|
|
},
|
|
"$defs": {
|
|
"caring_policy_metadata": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": ["profile"],
|
|
"properties": {
|
|
"profile": {"const": "caring-0.4.0-rc2"},
|
|
"enforce": {"type": "boolean"},
|
|
"canonical_roles": {
|
|
"type": "array",
|
|
"items": {"$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/canonical_role"},
|
|
"uniqueItems": true
|
|
},
|
|
"organization_relations": {
|
|
"type": "array",
|
|
"items": {"$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/organization_relation"},
|
|
"uniqueItems": true
|
|
},
|
|
"scopes": {
|
|
"type": "array",
|
|
"items": {"$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/scope"}
|
|
},
|
|
"planes": {
|
|
"type": "array",
|
|
"items": {"$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/plane"},
|
|
"uniqueItems": true
|
|
},
|
|
"capabilities": {
|
|
"type": "array",
|
|
"items": {"$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/capability"},
|
|
"uniqueItems": true
|
|
},
|
|
"exposure_modes": {
|
|
"type": "array",
|
|
"items": {"$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/exposure_mode"},
|
|
"uniqueItems": true
|
|
},
|
|
"conditions": {
|
|
"type": "array",
|
|
"items": {"$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/condition"},
|
|
"uniqueItems": true
|
|
},
|
|
"restrictions": {
|
|
"type": "array",
|
|
"items": {"$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/restriction"},
|
|
"uniqueItems": true
|
|
},
|
|
"metadata": {"type": "object", "additionalProperties": true}
|
|
}
|
|
}
|
|
}
|
|
}
|