You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -32,6 +32,7 @@ The canonical model for a permissions document is a JSON [JSON] object. When ser
32
32
}
33
33
}
34
34
```
35
+
35
36
In this example, the claim "PrintSettings.Read.All" is required when using the "DelegatedWork" security scheme to access the resource "/print/settings" using the "GET" method.
36
37
37
38
### permissions
@@ -43,13 +44,6 @@ The "permissions" member is a JSON object whose members permission objects. The
43
44
### note
44
45
The "note" member is a freeform string that provides additional details at about the permission that cannot be determined from the other members of the permission object.
45
46
46
-
### alsoRequires
47
-
The "alsoRequires" member is logical expression of permissions that must be presented as claims alongside the current permission.
48
-
49
-
```
50
-
(User.Read | User.Read.All) & Group.Read
51
-
```
52
-
53
47
### implicit
54
48
The "implicit" member is a boolean value that indicates that the current permission object is implied. The default value is "false". This member us usually set to "true" in combination with a "alsoRequires" expression.
55
49
@@ -77,20 +71,20 @@ TBD
77
71
The "ownerEmail" member is a REQUIRED string that provides a contact mechanism for communicating with the owner of the permission. It is important that owners of permissions are aware when new paths are added to an existing permission.
78
72
79
73
## <aname="pathSetObject"></a>PathSet Object
80
-
A pathSet object identifies a set of paths that are accessible via the identified HTTP methods and schemes. Ideally, a permission object contains a single pathSet object. This indicates that all paths protected by the permission support the same HTTP methods and and schemes. In practice there are cases where support is not uniform. Distinct pathSet objects can be created to separate the paths with varying support.
74
+
A pathSet object identifies a set of paths that are accessible have a common set of security characteristics, such as HTTP methods and schemes. Ideally, a permission object contains a single pathSet object. This indicates that all paths protected by the permission support the same characteristics. In practice there are cases where support is not uniform. Distinct pathSet objects can be created to separate the paths with varying characteristics.
81
75
82
76
> Note: The design chosen was intentional to encourage permission creators to ensure support for methods and schemes is as consistent as possible. This produces a better developer experience for API consumers.
83
77
84
78
```json
85
79
"pathSets": [{
86
-
"schemes": ["DelegatedWork"],
80
+
"schemeKeys": ["DelegatedWork"],
87
81
"methods": ["GET"],
88
82
"paths": {
89
83
"/print/settings": {}
90
84
}
91
85
},
92
86
{
93
-
"schemes": ["Application"],
87
+
"schemeKeys": ["Application"],
94
88
"methods": ["GET,POST"],
95
89
"paths": {
96
90
"/print/settings": {}
@@ -99,15 +93,29 @@ A pathSet object identifies a set of paths that are accessible via the identifie
99
93
]
100
94
```
101
95
102
-
### schemes
103
-
The "schemes" member is a REQUIRED array of strings that reference the schemes defined in the [permission object](#permissionObject) that are supported by the paths in this pathSet object.
96
+
### schemeKeys
97
+
The "schemeKeys" member is a REQUIRED array of strings that reference the schemes defined in the [permission object](#permissionObject) that are supported by the paths in this pathSet object. Each value in this array MUST match one of the keys of the "schemes" member in the [permission object](#permissionObject).
104
98
105
99
### methods
106
100
The "methods" member is a REQUIRED array of strings that represent the HTTP methods supported by the paths in this pathSet object.
107
101
108
102
### paths
109
103
The "paths" member is a REQUIRED object whose keys contain a simplified URI template to identify the resources protected by this permission object.
110
104
105
+
### alsoRequires
106
+
The "alsoRequires" member is logical expression of permissions that must be presented as claims alongside the current permission.
107
+
108
+
```
109
+
(User.Read | User.Read.All) & Group.Read
110
+
```
111
+
112
+
### includedProperties
113
+
The "includedProperties" member is an array of strings that identify properties of the resource representation returned by the path, that are accessible with the permission.
114
+
115
+
### excludedProperties
116
+
The "includedProperties" member is an array of strings that identify properties of the resource representation returned by the path, that are not accessible with the permission.
117
+
118
+
111
119
## <aname="schemeObject"></a>Scheme Object
112
120
The scheme object has members that describe the permission within the context of the scheme. Additional members provide behavioral constraints of the permission when used with the scheme.
113
121
@@ -121,16 +129,15 @@ The scheme object has members that describe the permission within the context of
121
129
"requiresAdminConsent": true
122
130
},
123
131
"DelegatedPersonal": {
124
-
"type": "DelegatedPersonal",
125
132
"consentDisplayName": "Read and write app activity to users'activity feed",
126
133
"consentDescription": "Allows the app to read and report the signed-in user's activity in the app."
127
134
},
128
135
"Application": {
129
-
"type": "Application",
130
136
"adminDisplayName": "Read and write app activity to users' activity feed",
131
137
"adminDescription": "Allows the app to read and report the signed-in user's activity in the app.",
132
138
}
133
139
```
140
+
134
141
### adminDisplayName
135
142
The "adminDisplayName" member is a string that provides a short permission name that considers the current scheme and the perspective of a resource administrator.
136
143
@@ -157,16 +164,50 @@ The path object contains properties that affect how the permission object contro
157
164
"excludedProperties": ["cost"]
158
165
}
159
166
```
167
+
160
168
### leastPrivilegePath
161
169
The "leastPrivilegePath" member is an array of strings that identify the schemes for which this permission is the least privilege permission for accessing the path.
162
170
163
-
### includedProperties
164
-
The "includedProperties" member is an array of strings that identify properties of the resource representation returned by the path, that are accessible with the permission.
171
+
## Appendix A. Model Diagram
165
172
166
-
### excludedProperties
167
-
The "includedProperties" member is an array of strings that identify properties of the resource representation returned by the path, that are not accessible with the permission.
0 commit comments