Skip to main content

auth_access

Typed specification

Generated by the pinned ess generate --kind docs from ess. Structural validation establishes consistency; behaviour, storage and cross-record predicates remain implementation obligations.

Proposed access selection, acquisition declaration and exact permission-budget values; no runtime or persistent owner.

connectors.auth_access is one of connectors's bounded contexts. Back to the index.

Types​

AccessMode​

connectors.auth_access.AccessMode is one of credential, direct_anonymous and parent_authenticated.

AccessSelection​

connectors.auth_access.AccessSelection is a record of seven fields:

  • profile — String
  • mode — connectors.auth_access.AccessMode
  • purpose — connectors.auth_access.Purpose
  • subject — connectors.auth_access.Subject
  • scheme — connectors.auth_access.Scheme
  • flow — connectors.auth_access.AcquisitionFlow
  • capability — connectors.auth_access.CapabilityName

Every value satisfies (not (mode == direct_anonymous) or (purpose == anonymous and subject == none and scheme == none and flow == static_config and capability == http-anonymous)) and (not (mode == parent_authenticated) or (purpose == mediated_access and subject == none and scheme == parent and flow == static_config and capability == mediated-http)).

AcquisitionDeclaration​

connectors.auth_access.AcquisitionDeclaration is a record of eight fields:

  • flow — connectors.auth_access.AcquisitionFlow
  • authorize_url — Optional<String>, which may be absent
  • token_url — Optional<String>, which may be absent
  • pkce — Optional<String>, which may be absent
  • registration_kind — Optional<String>, which may be absent
  • callback_binding — Optional<String>, which may be absent
  • grants — List<String>
  • sources — List<String>

AcquisitionFlow​

connectors.auth_access.AcquisitionFlow is one of static_config, static_entry, oauth2_authorization_code, oauth2_device_code, oauth2_client_credentials, oauth2_password, workload_identity, exec_plugin and host_issued.

AuthorizationCoverage​

connectors.auth_access.AuthorizationCoverage is a record of two fields:

  • complete — Boolean
  • targets — List<connectors.auth_access.AuthorizationTarget>

Every value satisfies targets.count <= 64 and (complete == false or forall t in targets: (t.result == allowed)).

AuthorizationResult​

connectors.auth_access.AuthorizationResult is one of allowed and denied.

AuthorizationTarget​

connectors.auth_access.AuthorizationTarget is a record of two fields:

  • target — connectors.auth_access.PermissionTarget
  • result — connectors.auth_access.AuthorizationResult

CapabilityName​

connectors.auth_access.CapabilityName is one of http-bearer, http-basic, http-signing, http-anonymous, mtls-client-identity, socket-peer, exec-credential-plugin, sip-credential-lease, session-authority, inbound-verifier and mediated-http.

PermissionBudget​

connectors.auth_access.PermissionBudget is a record of four fields:

  • target_limit — Integer
  • call_limit — Integer
  • concurrency_limit — Integer
  • deadline — Timestamp

Every value satisfies (target_limit >= 0 and target_limit <= 64), (call_limit >= 0 and call_limit <= 64) and (concurrency_limit >= 0 and concurrency_limit <= 4).

PermissionObservation​

connectors.auth_access.PermissionObservation is a record of three fields:

  • target — connectors.auth_access.PermissionTarget
  • result — connectors.auth_access.PermissionResult
  • cached — Boolean

PermissionResult​

connectors.auth_access.PermissionResult is one of allowed, denied and unavailable.

PermissionTarget​

connectors.auth_access.PermissionTarget is a record of two fields:

  • binding_ref — String
  • target_ref — String

Purpose​

connectors.auth_access.Purpose is one of service_account, delegated_user, app_level, inbound_verification, transport_identity, trunk_registration, anonymous and mediated_access.

Scheme​

connectors.auth_access.Scheme is one of http_bearer, http_basic, http_signing, mtls, socket_peer, exec_plugin, sip_digest, session_authority, none and parent.

Subject​

connectors.auth_access.Subject is one of app, user and none.

Four of the types above are reached by nothing else in this system: connectors.auth_access.AccessSelection, connectors.auth_access.AuthorizationCoverage, connectors.auth_access.PermissionBudget and connectors.auth_access.PermissionObservation. No entity, view, command, event, error or crossing names them, so it is either vocabulary something outside this specification uses or a leftover — and only a person can tell which.

Generated from connectors v1 · model digest e1e1672d0af4753cb8f2da6c0b22a7f6ae8ce9f7abc168f86169babdf1325787 · contract digest slice-sha256/2:0caf63883d11853dc8ff338e2e1b001b8ed88aa43394b57ba5244f88ee5dfb7e. Do not edit this file; change the specification and regenerate it with ess generate.