|
1119 | 1119 | "title": "UpdateAppConfigFragmentInput", |
1120 | 1120 | "type": "object" |
1121 | 1121 | }, |
| 1122 | + "AppConfigAccessLevel": { |
| 1123 | + "description": "Minimum principal tier allowed to read or write a config layer (BEP-1052).\n\nOrdered least → most privileged: ``public`` < ``authenticated`` < ``owner`` < ``admin``.\nStored per ``(config_name, scope_type)`` on the allow-list — once for read, once for\nwrite — so read-enablement and write-authorization are independent concerns. The\nallow-list row's existence no longer implies write access: it only registers the layer\nand its merge ``rank`` (the read side), while ``write_access`` decides who may write.\n\n``owner`` is resolved relative to the fragment's scope: the user itself for ``user``\nscope, the domain admin for ``domain``. ``admin`` (superadmin) always satisfies any tier.", |
| 1124 | + "enum": [ |
| 1125 | + "public", |
| 1126 | + "authenticated", |
| 1127 | + "owner", |
| 1128 | + "admin" |
| 1129 | + ], |
| 1130 | + "title": "AppConfigAccessLevel", |
| 1131 | + "type": "string" |
| 1132 | + }, |
1122 | 1133 | "CreateAppConfigAllowListInput": { |
1123 | 1134 | "description": "Input for registering a new app config allow-list entry.", |
1124 | 1135 | "properties": { |
|
1145 | 1156 | "default": null, |
1146 | 1157 | "description": "Merge rank applied to fragments under this entry (low to high; higher wins). Defaults to the scope type's default rank (public=100, domain=200, user=300).", |
1147 | 1158 | "title": "Rank" |
| 1159 | + }, |
| 1160 | + "read_access": { |
| 1161 | + "anyOf": [ |
| 1162 | + { |
| 1163 | + "$ref": "#/components/schemas/AppConfigAccessLevel" |
| 1164 | + }, |
| 1165 | + { |
| 1166 | + "type": "null" |
| 1167 | + } |
| 1168 | + ], |
| 1169 | + "default": null, |
| 1170 | + "description": "Minimum principal tier allowed to read the fragments under this entry. Defaults to the scope type's default (public=public, domain=authenticated, user=owner)." |
| 1171 | + }, |
| 1172 | + "write_access": { |
| 1173 | + "anyOf": [ |
| 1174 | + { |
| 1175 | + "$ref": "#/components/schemas/AppConfigAccessLevel" |
| 1176 | + }, |
| 1177 | + { |
| 1178 | + "type": "null" |
| 1179 | + } |
| 1180 | + ], |
| 1181 | + "default": null, |
| 1182 | + "description": "Minimum principal tier allowed to write the fragments under this entry. Defaults to the scope type's default (public=admin, domain=admin, user=owner)." |
1148 | 1183 | } |
1149 | 1184 | }, |
1150 | 1185 | "required": [ |
|
1405 | 1440 | "type": "object" |
1406 | 1441 | }, |
1407 | 1442 | "UpdateAppConfigAllowListInput": { |
1408 | | - "description": "Input for updating an app config allow-list entry.\n\nOnly ``rank`` is updatable — the identity pair (``config_name``, ``scope_type``)\nis immutable (purge and recreate to change it).", |
| 1443 | + "description": "Input for updating an app config allow-list entry.\n\n``rank`` and the access tiers (``read_access`` / ``write_access``) are updatable — the\nidentity pair (``config_name``, ``scope_type``) is immutable (purge and recreate to\nchange it).", |
1409 | 1444 | "properties": { |
1410 | 1445 | "id": { |
1411 | 1446 | "description": "App config allow-list entry id to update.", |
|
1425 | 1460 | "default": null, |
1426 | 1461 | "description": "New merge rank applied to fragments under this entry (low to high; higher wins). Omit to leave unchanged.", |
1427 | 1462 | "title": "Rank" |
| 1463 | + }, |
| 1464 | + "read_access": { |
| 1465 | + "anyOf": [ |
| 1466 | + { |
| 1467 | + "$ref": "#/components/schemas/AppConfigAccessLevel" |
| 1468 | + }, |
| 1469 | + { |
| 1470 | + "type": "null" |
| 1471 | + } |
| 1472 | + ], |
| 1473 | + "default": null, |
| 1474 | + "description": "New minimum principal tier allowed to read the fragments under this entry. Omit to leave unchanged." |
| 1475 | + }, |
| 1476 | + "write_access": { |
| 1477 | + "anyOf": [ |
| 1478 | + { |
| 1479 | + "$ref": "#/components/schemas/AppConfigAccessLevel" |
| 1480 | + }, |
| 1481 | + { |
| 1482 | + "type": "null" |
| 1483 | + } |
| 1484 | + ], |
| 1485 | + "default": null, |
| 1486 | + "description": "New minimum principal tier allowed to write the fragments under this entry. Omit to leave unchanged." |
1428 | 1487 | } |
1429 | 1488 | }, |
1430 | 1489 | "required": [ |
|
0 commit comments