Policy.schema.json

{ "$id": "https://api.cerbos.dev/v0.36.0/cerbos/policy/v1/Policy.schema.json", "$schema": "http://json-schema.org/draft-07/schema#", "definitions": { "cerbos.policy.v1.Condition": { "allOf": [
{
"type": "object",
"additionalProperties": false,
"properties": {
"match": {
"$ref": "#/definitions/cerbos.policy.v1.Match"
},
"script": {
"type": "string"
}
}
},
{
"oneOf": [
{
"type": "object",
"required": [
"match"
]
},
{
"type": "object",
"required": [
"script"
]
}
]
}
] }, "cerbos.policy.v1.DerivedRoles": { "type": "object", "required": [
"name",
"definitions"
], "additionalProperties": false, "properties": { "definitions": { "type": "array", "items": { "$ref": "#/definitions/cerbos.policy.v1.RoleDef" }, "minItems": 1 }, "name": { "type": "string", "minLength": 1, "pattern": "^[\-\.0-9A-Z_a-z]+$" }, "variables": { "$ref": "#/definitions/cerbos.policy.v1.Variables" } } }, "cerbos.policy.v1.ExportVariables": { "type": "object", "required": [
"name"
], "additionalProperties": false, "properties": { "definitions": { "type": "object", "additionalProperties": { "type": "string" } }, "name": { "type": "string", "minLength": 1, "pattern": "^[\-\.0-9A-Z_a-z]+$" } } }, "cerbos.policy.v1.Match": { "allOf": [
{
"type": "object",
"additionalProperties": false,
"properties": {
"all": {
"$ref": "#/definitions/cerbos.policy.v1.Match.ExprList"
},
"any": {
"$ref": "#/definitions/cerbos.policy.v1.Match.ExprList"
},
"expr": {
"type": "string"
},
"none": {
"$ref": "#/definitions/cerbos.policy.v1.Match.ExprList"
}
}
},
{
"oneOf": [
{
"type": "object",
"required": [
"all"
]
},
{
"type": "object",
"required": [
"any"
]
},
{
"type": "object",
"required": [
"none"
]
},
{
"type": "object",
"required": [
"expr"
]
}
]
}
] }, "cerbos.policy.v1.Match.ExprList": { "type": "object", "required": [
"of"
], "additionalProperties": false, "properties": { "of": { "type": "array", "items": { "$ref": "#/definitions/cerbos.policy.v1.Match" }, "minItems": 1 } } }, "cerbos.policy.v1.Metadata": { "type": "object", "additionalProperties": false, "properties": { "annotations": { "type": "object", "additionalProperties": { "type": "string" } }, "hash": { "oneOf": [
{
"type": "integer",
"minimum": 0
},
{
"type": "string",
"pattern": "^(?:0|[1-9]\\d*)(?:\.\\d+)?(?:[eE][+-]?\\d+)?$"
}
] }, "sourceAttributes": { "$ref": "#/definitions/cerbos.policy.v1.SourceAttributes" }, "sourceFile": { "type": "string" }, "storeIdentifer": { "type": "string" }, "storeIdentifier": { "type": "string" } } }, "cerbos.policy.v1.Output": { "type": "object", "additionalProperties": false, "properties": { "expr": { "type": "string" }, "when": { "$ref": "#/definitions/cerbos.policy.v1.Output.When" } } }, "cerbos.policy.v1.Output.When": { "type": "object", "additionalProperties": false, "properties": { "conditionNotMet": { "type": "string" }, "ruleActivated": { "type": "string" } } }, "cerbos.policy.v1.PrincipalPolicy": { "type": "object", "required": [
"principal",
"version"
], "additionalProperties": false, "properties": { "principal": { "type": "string", "minLength": 1 }, "rules": { "type": "array", "items": { "$ref": "#/definitions/cerbos.policy.v1.PrincipalRule" } }, "scope": { "type": "string", "pattern": "^([0-9A-Za-z][\-0-9A-Z_a-z]*(\.[\-0-9A-Z_a-z]*)*)*$" }, "variables": { "$ref": "#/definitions/cerbos.policy.v1.Variables" }, "version": { "type": "string", "pattern": "^[0-9A-Z_a-z]+$" } } }, "cerbos.policy.v1.PrincipalRule": { "type": "object", "required": [
"resource",
"actions"
], "additionalProperties": false, "properties": { "actions": { "type": "array", "items": { "$ref": "#/definitions/cerbos.policy.v1.PrincipalRule.Action" }, "minItems": 1 }, "resource": { "type": "string", "minLength": 1 } } }, "cerbos.policy.v1.PrincipalRule.Action": { "type": "object", "required": [
"action",
"effect"
], "additionalProperties": false, "properties": { "action": { "type": "string", "minLength": 1 }, "condition": { "$ref": "#/definitions/cerbos.policy.v1.Condition" }, "effect": { "type": "string", "enum": [
"EFFECT_ALLOW",
"EFFECT_DENY"
] }, "name": { "type": "string", "pattern": "^([A-Za-z][\-\.0-9@-Z_a-z]*)*$" }, "output": { "$ref": "#/definitions/cerbos.policy.v1.Output" } } }, "cerbos.policy.v1.ResourcePolicy": { "type": "object", "required": [
"resource",
"version"
], "additionalProperties": false, "properties": { "importDerivedRoles": { "type": "array", "items": { "type": "string", "pattern": "^[\-\.0-9A-Z_a-z]+$" }, "uniqueItems": true }, "resource": { "type": "string", "minLength": 1 }, "rules": { "type": "array", "items": { "$ref": "#/definitions/cerbos.policy.v1.ResourceRule" } }, "schemas": { "$ref": "#/definitions/cerbos.policy.v1.Schemas" }, "scope": { "type": "string", "pattern": "^([0-9A-Za-z][\-0-9A-Z_a-z]*(\.[\-0-9A-Z_a-z]*)*)*$" }, "variables": { "$ref": "#/definitions/cerbos.policy.v1.Variables" }, "version": { "type": "string", "pattern": "^[0-9A-Z_a-z]+$" } } }, "cerbos.policy.v1.ResourceRule": { "type": "object", "required": [
"actions",
"effect"
], "additionalProperties": false, "properties": { "actions": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1, "uniqueItems": true }, "condition": { "$ref": "#/definitions/cerbos.policy.v1.Condition" }, "derivedRoles": { "type": "array", "items": { "type": "string", "pattern": "^[\-\.0-9A-Z_a-z]+$" }, "uniqueItems": true }, "effect": { "type": "string", "enum": [
"EFFECT_ALLOW",
"EFFECT_DENY"
] }, "name": { "type": "string", "pattern": "^([A-Za-z][\-\.0-9@-Z_a-z]*)*$" }, "output": { "$ref": "#/definitions/cerbos.policy.v1.Output" }, "roles": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true } } }, "cerbos.policy.v1.RoleDef": { "type": "object", "required": [
"name",
"parentRoles"
], "additionalProperties": false, "properties": { "condition": { "$ref": "#/definitions/cerbos.policy.v1.Condition" }, "name": { "type": "string", "pattern": "^[\-\.0-9A-Z_a-z]+$" }, "parentRoles": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1, "uniqueItems": true } } }, "cerbos.policy.v1.Schemas": { "type": "object", "additionalProperties": false, "properties": { "principalSchema": { "$ref": "#/definitions/cerbos.policy.v1.Schemas.Schema" }, "resourceSchema": { "$ref": "#/definitions/cerbos.policy.v1.Schemas.Schema" } } }, "cerbos.policy.v1.Schemas.IgnoreWhen": { "type": "object", "required": [
"actions"
], "additionalProperties": false, "properties": { "actions": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1, "uniqueItems": true } } }, "cerbos.policy.v1.Schemas.Schema": { "type": "object", "required": [
"ref"
], "additionalProperties": false, "properties": { "ignoreWhen": { "$ref": "#/definitions/cerbos.policy.v1.Schemas.IgnoreWhen" }, "ref": { "type": "string", "minLength": 1 } } }, "cerbos.policy.v1.SourceAttributes": { "type": "object", "additionalProperties": false, "properties": { "attributes": { "type": "object", "additionalProperties": { "$ref": "#/definitions/google.protobuf.Value" } } } }, "cerbos.policy.v1.Variables": { "type": "object", "additionalProperties": false, "properties": { "import": { "type": "array", "items": { "type": "string", "pattern": "^[\-\.0-9A-Z_a-z]+$" }, "uniqueItems": true }, "local": { "type": "object", "additionalProperties": { "type": "string" } } } }, "google.protobuf.Value": { "title": "Value", "description": "A dynamically-typed value." } }, "allOf": [
{
"type": "object",
"required": [
"apiVersion"
],
"additionalProperties": false,
"properties": {
"$schema": {
"type": "string"
},
"apiVersion": {
"type": "string",
"const": "api.cerbos.dev/v1"
},
"derivedRoles": {
"$ref": "#/definitions/cerbos.policy.v1.DerivedRoles"
},
"description": {
"type": "string"
},
"disabled": {
"type": "boolean"
},
"exportVariables": {
"$ref": "#/definitions/cerbos.policy.v1.ExportVariables"
},
"metadata": {
"$ref": "#/definitions/cerbos.policy.v1.Metadata"
},
"principalPolicy": {
"$ref": "#/definitions/cerbos.policy.v1.PrincipalPolicy"
},
"resourcePolicy": {
"$ref": "#/definitions/cerbos.policy.v1.ResourcePolicy"
},
"variables": {
"type": "object",
"additionalProperties": {
"type": "string"
}
}
}
},
{
"oneOf": [
{
"type": "object",
"required": [
"resourcePolicy"
]
},
{
"type": "object",
"required": [
"principalPolicy"
]
},
{
"type": "object",
"required": [
"derivedRoles"
]
},
{
"type": "object",
"required": [
"exportVariables"
]
}
]
}
] }