Policy.schema.json

{ "$id": "https://api.cerbos.dev/v0.53.0/cerbos/policy/v1/Policy.schema.json", "$schema": "http://json-schema.org/draft-07/schema#", "definitions": { "cerbos.policy.v1.Condition": { "allOf": [
{
"type": "object",
"additionalProperties": false,
"properties": {
"match": {
"$ref": "#/definitions/cerbos.policy.v1.Match"
},
"script": {
"type": "string"
}
}
},
{
"oneOf": [
{
"type": "object",
"required": [
"match"
]
},
{
"type": "object",
"required": [
"script"
]
}
]
}
] }, "cerbos.policy.v1.Constants": { "type": "object", "additionalProperties": false, "properties": { "import": { "type": "array", "items": { "type": "string", "pattern": "^[\-\.0-9A-Z_a-z]+$" }, "uniqueItems": true }, "local": { "type": "object", "additionalProperties": { "$ref": "#/definitions/google.protobuf.Value" } } } }, "cerbos.policy.v1.DerivedRoles": { "type": "object", "required": [
"name",
"definitions"
], "additionalProperties": false, "properties": { "constants": { "$ref": "#/definitions/cerbos.policy.v1.Constants" }, "definitions": { "type": "array", "items": { "$ref": "#/definitions/cerbos.policy.v1.RoleDef" }, "minItems": 1 }, "name": { "type": "string", "minLength": 1, "pattern": "^[\-\.0-9A-Z_a-z]+$" }, "variables": { "$ref": "#/definitions/cerbos.policy.v1.Variables" } } }, "cerbos.policy.v1.ExportConstants": { "type": "object", "required": [
"name"
], "additionalProperties": false, "properties": { "definitions": { "type": "object", "additionalProperties": { "$ref": "#/definitions/google.protobuf.Value" } }, "name": { "type": "string", "minLength": 1, "pattern": "^[\-\.0-9A-Z_a-z]+$" } } }, "cerbos.policy.v1.ExportVariables": { "type": "object", "required": [
"name"
], "additionalProperties": false, "properties": { "definitions": { "type": "object", "additionalProperties": { "type": "string" } }, "name": { "type": "string", "minLength": 1, "pattern": "^[\-\.0-9A-Z_a-z]+$" } } }, "cerbos.policy.v1.Match": { "allOf": [
{
"type": "object",
"additionalProperties": false,
"properties": {
"all": {
"$ref": "#/definitions/cerbos.policy.v1.Match.ExprList"
},
"any": {
"$ref": "#/definitions/cerbos.policy.v1.Match.ExprList"
},
"expr": {
"type": "string"
},
"none": {
"$ref": "#/definitions/cerbos.policy.v1.Match.ExprList"
}
}
},
{
"oneOf": [
{
"type": "object",
"required": [
"all"
]
},
{
"type": "object",
"required": [
"any"
]
},
{
"type": "object",
"required": [
"none"
]
},
{
"type": "object",
"required": [
"expr"
]
}
]
}
] }, "cerbos.policy.v1.Match.ExprList": { "type": "object", "required": [
"of"
], "additionalProperties": false, "properties": { "of": { "type": "array", "items": { "$ref": "#/definitions/cerbos.policy.v1.Match" }, "minItems": 1 } } }, "cerbos.policy.v1.Metadata": { "type": "object", "additionalProperties": false, "properties": { "annotations": { "type": "object", "additionalProperties": { "type": "string" } }, "hash": { "oneOf": [
{
"type": "integer",
"minimum": 0
},
{
"type": "string",
"pattern": "^(?:0|[1-9]\\d*)(?:\.\\d+)?(?:[eE][+-]?\\d+)?$"
}
] }, "sourceAttributes": { "$ref": "#/definitions/cerbos.policy.v1.SourceAttributes" }, "sourceFile": { "type": "string" }, "storeIdentifer": { "type": "string" }, "storeIdentifier": { "type": "string" } } }, "cerbos.policy.v1.Output": { "type": "object", "additionalProperties": false, "properties": { "expr": { "type": "string" }, "when": { "$ref": "#/definitions/cerbos.policy.v1.Output.When" } } }, "cerbos.policy.v1.Output.When": { "type": "object", "additionalProperties": false, "properties": { "conditionNotMet": { "type": "string" }, "ruleActivated": { "type": "string" } } }, "cerbos.policy.v1.PrincipalPolicy": { "type": "object", "required": [
"principal",
"version"
], "additionalProperties": false, "properties": { "constants": { "$ref": "#/definitions/cerbos.policy.v1.Constants" }, "principal": { "type": "string", "pattern": "^[^!\\\?\\[\\]\{\}]+$" }, "rules": { "type": "array", "items": { "$ref": "#/definitions/cerbos.policy.v1.PrincipalRule" } }, "scope": { "type": "string", "pattern": "^(^$|\.|[0-9A-Za-z][\-0-9A-Z_a-z]*(\.[0-9A-Z_a-z][\-0-9A-Z_a-z]*)*)$" }, "scopePermissions": { "$ref": "#/definitions/cerbos.policy.v1.ScopePermissions" }, "variables": { "$ref": "#/definitions/cerbos.policy.v1.Variables" }, "version": { "type": "string", "pattern": "^[0-9A-Z_a-z]+$" } } }, "cerbos.policy.v1.PrincipalRule": { "type": "object", "required": [
"resource",
"actions"
], "additionalProperties": false, "properties": { "actions": { "type": "array", "items": { "$ref": "#/definitions/cerbos.policy.v1.PrincipalRule.Action" }, "minItems": 1 }, "resource": { "type": "string", "minLength": 1 } } }, "cerbos.policy.v1.PrincipalRule.Action": { "type": "object", "required": [
"action",
"effect"
], "additionalProperties": false, "properties": { "action": { "type": "string", "minLength": 1 }, "condition": { "$ref": "#/definitions/cerbos.policy.v1.Condition" }, "effect": { "type": "string", "enum": [
"EFFECT_ALLOW",
"EFFECT_DENY"
] }, "name": { "type": "string", "pattern": "^([A-Za-z][\-\.0-9@-Z_a-z]*)*$" }, "output": { "$ref": "#/definitions/cerbos.policy.v1.Output" } } }, "cerbos.policy.v1.ResourcePolicy": { "type": "object", "required": [
"resource",
"version"
], "additionalProperties": false, "properties": { "constants": { "$ref": "#/definitions/cerbos.policy.v1.Constants" }, "importDerivedRoles": { "type": "array", "items": { "type": "string", "pattern": "^[\-\.0-9A-Z_a-z]+$" }, "uniqueItems": true }, "resource": { "type": "string", "pattern": "^[^!\\\?\\[\\]\{\}]+$" }, "rules": { "type": "array", "items": { "$ref": "#/definitions/cerbos.policy.v1.ResourceRule" } }, "schemas": { "$ref": "#/definitions/cerbos.policy.v1.Schemas" }, "scope": { "type": "string", "pattern": "^(^$|\.|[0-9A-Za-z][\-0-9A-Z_a-z]*(\.[0-9A-Z_a-z][\-0-9A-Z_a-z]*)*)$" }, "scopePermissions": { "$ref": "#/definitions/cerbos.policy.v1.ScopePermissions" }, "variables": { "$ref": "#/definitions/cerbos.policy.v1.Variables" }, "version": { "type": "string", "pattern": "^[0-9A-Z_a-z]+$" } } }, "cerbos.policy.v1.ResourceRule": { "type": "object", "required": [
"actions",
"effect"
], "additionalProperties": false, "properties": { "actions": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1, "uniqueItems": true }, "condition": { "$ref": "#/definitions/cerbos.policy.v1.Condition" }, "derivedRoles": { "type": "array", "items": { "type": "string", "pattern": "^[\-\.0-9A-Z_a-z]+$" }, "uniqueItems": true }, "effect": { "type": "string", "enum": [
"EFFECT_ALLOW",
"EFFECT_DENY"
] }, "name": { "type": "string", "pattern": "^([A-Za-z][\-\.0-9@-Z_a-z]*)*$" }, "output": { "$ref": "#/definitions/cerbos.policy.v1.Output" }, "roles": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true } } }, "cerbos.policy.v1.RoleDef": { "type": "object", "required": [
"name",
"parentRoles"
], "additionalProperties": false, "properties": { "condition": { "$ref": "#/definitions/cerbos.policy.v1.Condition" }, "name": { "type": "string", "pattern": "^[\-\.0-9A-Z_a-z]+$" }, "parentRoles": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1, "uniqueItems": true } } }, "cerbos.policy.v1.RolePolicy": { "allOf": [
{
"type": "object",
"additionalProperties": false,
"properties": {
"parentRoles": {
"type": "array",
"items": {
"type": "string",
"minLength": 1
},
"uniqueItems": true
},
"role": {
"type": "string",
"pattern": "^[^!\\*\?\\[\\]\{\}]+$"
},
"rules": {
"type": "array",
"items": {
"$ref": "#/definitions/cerbos.policy.v1.RoleRule"
}
},
"scope": {
"type": "string",
"pattern": "^(^$|\.|[0-9A-Za-z][\-0-9A-Z_a-z]*(\.[0-9A-Z_a-z][\-0-9A-Z_a-z]*)*)$"
},
"scopePermissions": {
"type": "string",
"enum": [
"SCOPE_PERMISSIONS_UNSPECIFIED",
"SCOPE_PERMISSIONS_REQUIRE_PARENTAL_CONSENT_FOR_ALLOWS"
]
},
"version": {
"type": "string",
"pattern": "^[0-9A-Z_a-z]*$"
}
}
},
{
"type": "object",
"required": [
"role"
]
}
] }, "cerbos.policy.v1.RoleRule": { "type": "object", "required": [
"resource",
"allowActions"
], "additionalProperties": false, "properties": { "allowActions": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1, "uniqueItems": true }, "condition": { "$ref": "#/definitions/cerbos.policy.v1.Condition" }, "resource": { "type": "string", "minLength": 1 } } }, "cerbos.policy.v1.Schemas": { "type": "object", "additionalProperties": false, "properties": { "principalSchema": { "$ref": "#/definitions/cerbos.policy.v1.Schemas.Schema" }, "resourceSchema": { "$ref": "#/definitions/cerbos.policy.v1.Schemas.Schema" } } }, "cerbos.policy.v1.Schemas.IgnoreWhen": { "type": "object", "required": [
"actions"
], "additionalProperties": false, "properties": { "actions": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1, "uniqueItems": true } } }, "cerbos.policy.v1.Schemas.Schema": { "type": "object", "required": [
"ref"
], "additionalProperties": false, "properties": { "ignoreWhen": { "$ref": "#/definitions/cerbos.policy.v1.Schemas.IgnoreWhen" }, "ref": { "type": "string", "minLength": 1 } } }, "cerbos.policy.v1.ScopePermissions": { "type": "string", "enum": [
"SCOPE_PERMISSIONS_UNSPECIFIED",
"SCOPE_PERMISSIONS_OVERRIDE_PARENT",
"SCOPE_PERMISSIONS_REQUIRE_PARENTAL_CONSENT_FOR_ALLOWS"
] }, "cerbos.policy.v1.SourceAttributes": { "type": "object", "additionalProperties": false, "properties": { "attributes": { "type": "object", "additionalProperties": { "$ref": "#/definitions/google.protobuf.Value" } } } }, "cerbos.policy.v1.Variables": { "type": "object", "additionalProperties": false, "properties": { "import": { "type": "array", "items": { "type": "string", "pattern": "^[\-\.0-9A-Z_a-z]+$" }, "uniqueItems": true }, "local": { "type": "object", "additionalProperties": { "type": "string" } } } }, "google.protobuf.Value": { "title": "Value", "description": "A dynamically-typed value." } }, "allOf": [
{
"type": "object",
"required": [
"apiVersion"
],
"additionalProperties": false,
"properties": {
"$schema": {
"type": "string"
},
"apiVersion": {
"type": "string",
"const": "api.cerbos.dev/v1"
},
"derivedRoles": {
"$ref": "#/definitions/cerbos.policy.v1.DerivedRoles"
},
"description": {
"type": "string"
},
"disabled": {
"type": "boolean"
},
"exportConstants": {
"$ref": "#/definitions/cerbos.policy.v1.ExportConstants"
},
"exportVariables": {
"$ref": "#/definitions/cerbos.policy.v1.ExportVariables"
},
"metadata": {
"$ref": "#/definitions/cerbos.policy.v1.Metadata"
},
"principalPolicy": {
"$ref": "#/definitions/cerbos.policy.v1.PrincipalPolicy"
},
"resourcePolicy": {
"$ref": "#/definitions/cerbos.policy.v1.ResourcePolicy"
},
"rolePolicy": {
"$ref": "#/definitions/cerbos.policy.v1.RolePolicy"
},
"variables": {
"type": "object",
"additionalProperties": {
"type": "string"
}
}
}
},
{
"oneOf": [
{
"type": "object",
"required": [
"resourcePolicy"
]
},
{
"type": "object",
"required": [
"principalPolicy"
]
},
{
"type": "object",
"required": [
"derivedRoles"
]
},
{
"type": "object",
"required": [
"exportVariables"
]
},
{
"type": "object",
"required": [
"rolePolicy"
]
},
{
"type": "object",
"required": [
"exportConstants"
]
}
]
}
] }