@leaflow/sdk 0.6.0 → 0.7.0

package/openapi/iam.yaml

@@ -1,2242 +0,0 @@
-components:
-  schemas:
-    AcceptConsentsRequestBody:
-      additionalProperties: false
-      properties:
-        consents:
-          items:
-            $ref: "#/components/schemas/ConsentBody"
-          type:
-            - array
-            - "null"
-      required:
-        - consents
-      type: object
-    AcceptInvitationByTokenRequestBody:
-      additionalProperties: false
-      properties:
-        token:
-          maxLength: 128
-          minLength: 1
-          type: string
-      required:
-        - token
-      type: object
-    AcceptedInvitationResponseBody:
-      additionalProperties: false
-      properties:
-        project:
-          $ref: "#/components/schemas/ProjectResource"
-      required:
-        - project
-      type: object
-    AccountResource:
-      additionalProperties: false
-      properties:
-        created_at:
-          format: date-time
-          type: string
-        email:
-          type: string
-        email_verified_at:
-          format: date-time
-          type:
-            - string
-            - "null"
-        first_name:
-          description: 来自登录信息，可能为空
-          type: string
-        id:
-          description: 身份提供方签发的 subject
-          type: string
-        last_name:
-          description: 来自登录信息，可能为空
-          type: string
-        pending_agreements:
-          items:
-            $ref: "#/components/schemas/AgreementResource"
-          type:
-            - array
-            - "null"
-        status:
-          enum:
-            - ACTIVE
-            - SUSPENDED
-            - BANNED
-            - DELETING
-          type: string
-      required:
-        - id
-        - email
-        - first_name
-        - last_name
-        - status
-        - email_verified_at
-        - created_at
-        - pending_agreements
-      type: object
-    AgreementListResponseBody:
-      additionalProperties: false
-      properties:
-        items:
-          items:
-            $ref: "#/components/schemas/AgreementResource"
-          type:
-            - array
-            - "null"
-      required:
-        - items
-      type: object
-    AgreementResource:
-      additionalProperties: false
-      properties:
-        effective_at:
-          description: 从这一刻起注册必须同意这一版
-          format: date-time
-          type: string
-        type:
-          enum:
-            - TERMS
-            - PRIVACY
-            - DPA
-          type: string
-        url:
-          description: 正文发布在哪
-          type: string
-        version:
-          description: 同意时原样回传这个值
-          type: string
-      required:
-        - type
-        - version
-        - url
-        - effective_at
-      type: object
-    ConsentBody:
-      additionalProperties: false
-      properties:
-        type:
-          enum:
-            - TERMS
-            - PRIVACY
-            - DPA
-          type: string
-        version:
-          maxLength: 32
-          type: string
-      required:
-        - type
-        - version
-      type: object
-    ConsentListResponseBody:
-      additionalProperties: false
-      properties:
-        items:
-          items:
-            $ref: "#/components/schemas/ConsentResource"
-          type:
-            - array
-            - "null"
-      required:
-        - items
-      type: object
-    ConsentResource:
-      additionalProperties: false
-      properties:
-        consented_at:
-          format: date-time
-          type: string
-        method:
-          description: OFFLINE 是线下签的，由运营录入
-          enum:
-            - CLICKWRAP
-            - OFFLINE
-          type: string
-        type:
-          enum:
-            - TERMS
-            - PRIVACY
-            - DPA
-          type: string
-        version:
-          type: string
-      required:
-        - type
-        - version
-        - consented_at
-        - method
-      type: object
-    CreateProjectRequestBody:
-      additionalProperties: false
-      properties:
-        description:
-          maxLength: 2000
-          type: string
-        name:
-          maxLength: 128
-          minLength: 1
-          type: string
-      required:
-        - name
-      type: object
-    CreateRoleRequestBody:
-      additionalProperties: false
-      properties:
-        code:
-          description: 小写字母开头，可含数字和下划线。建好之后不能改——成员绑定和邀请都指着它
-          maxLength: 64
-          type: string
-        description:
-          maxLength: 255
-          type: string
-        name:
-          maxLength: 64
-          type: string
-        permissions:
-          description: 权限名。OwnerOnly 的那几条会被拒绝：绑上去也不会生效
-          items:
-            type: string
-          type:
-            - array
-            - "null"
-      required:
-        - code
-        - name
-      type: object
-    CreateSSHKeyRequestBody:
-      additionalProperties: false
-      properties:
-        name:
-          maxLength: 128
-          type: string
-        owner:
-          default: me
-          description: 这把钥匙归谁
-          enum:
-            - me
-            - project
-          type: string
-        public_key:
-          description: OpenSSH 格式的公钥。类型和指纹从它算出来，都不可改
-          maxLength: 16384
-          type: string
-        purposes:
-          description: 用途标签，比如 ci、bastion
-          items:
-            type: string
-          maxItems: 16
-          type:
-            - array
-            - "null"
-      required:
-        - name
-        - public_key
-      type: object
-    Error:
-      additionalProperties: false
-      properties:
-        code:
-          type: string
-        message:
-          type: string
-        meta:
-          additionalProperties: {}
-          type: object
-        status:
-          format: int64
-          type: integer
-      required:
-        - status
-        - message
-      type: object
-    GrantResource:
-      additionalProperties: false
-      properties:
-        admin:
-          type: boolean
-        owner:
-          type: boolean
-        permissions:
-          description: 持有的全部自定义角色的权限并集，已去重排序
-          items:
-            type: string
-          type:
-            - array
-            - "null"
-        roles:
-          description: 持有的角色编码，只用于展示
-          items:
-            type: string
-          type:
-            - array
-            - "null"
-      required:
-        - owner
-        - admin
-        - permissions
-        - roles
-      type: object
-    IdentityVerificationResource:
-      additionalProperties: false
-      properties:
-        reject_reason:
-          type: string
-        status:
-          description: PERSONAL 和 ENTERPRISE 是两类主体而不是两个等级，别拿它们比大小
-          enum:
-            - UNVERIFIED
-            - PENDING
-            - PERSONAL
-            - ENTERPRISE
-            - REJECTED
-          type: string
-        submitted_at:
-          format: date-time
-          type:
-            - string
-            - "null"
-        verified_at:
-          format: date-time
-          type:
-            - string
-            - "null"
-      required:
-        - status
-        - submitted_at
-        - verified_at
-        - reject_reason
-      type: object
-    InvitationResource:
-      additionalProperties: false
-      properties:
-        created_at:
-          format: date-time
-          type: string
-        email:
-          type: string
-        expires_at:
-          format: date-time
-          type: string
-        id:
-          format: uuid
-          type: string
-        invited_by:
-          type: string
-        project_id:
-          format: uuid
-          type: string
-        roles:
-          description: 兑现时会授予的角色编码
-          items:
-            type: string
-          type:
-            - array
-            - "null"
-      required:
-        - id
-        - project_id
-        - email
-        - roles
-        - invited_by
-        - expires_at
-        - created_at
-      type: object
-    IssueInvitationRequestBody:
-      additionalProperties: false
-      properties:
-        email:
-          format: email
-          maxLength: 320
-          type: string
-        roles:
-          description: 兑现时授予的角色编码。必须是这个项目已经定义的，OWNER 不行
-          items:
-            type: string
-          minItems: 1
-          type:
-            - array
-            - "null"
-      required:
-        - email
-        - roles
-      type: object
-    IssuedInvitationResponseBody:
-      additionalProperties: false
-      properties:
-        invitation:
-          $ref: "#/components/schemas/InvitationResource"
-        token:
-          description: 兑现用的明文，**只在这一次响应里出现**。库里只有它的哈希，丢了只能撤销重发
-          type: string
-      required:
-        - invitation
-        - token
-      type: object
-    LengthAwarePageInvitationResource:
-      additionalProperties: false
-      properties:
-        items:
-          description: 这一页的内容
-          items:
-            $ref: "#/components/schemas/InvitationResource"
-          type: array
-        limit:
-          description: 这一页最多几条，回显请求里的值
-          format: int64
-          type: integer
-        offset:
-          description: 跳过了多少条，回显请求里的值
-          format: int64
-          type: integer
-        total:
-          description: 命中的总条数，不只是这一页
-          format: int64
-          type: integer
-      required:
-        - items
-        - total
-        - limit
-        - offset
-      type: object
-    LengthAwarePageMemberResource:
-      additionalProperties: false
-      properties:
-        items:
-          description: 这一页的内容
-          items:
-            $ref: "#/components/schemas/MemberResource"
-          type: array
-        limit:
-          description: 这一页最多几条，回显请求里的值
-          format: int64
-          type: integer
-        offset:
-          description: 跳过了多少条，回显请求里的值
-          format: int64
-          type: integer
-        total:
-          description: 命中的总条数，不只是这一页
-          format: int64
-          type: integer
-      required:
-        - items
-        - total
-        - limit
-        - offset
-      type: object
-    LengthAwarePageProjectAccessResource:
-      additionalProperties: false
-      properties:
-        items:
-          description: 这一页的内容
-          items:
-            $ref: "#/components/schemas/ProjectAccessResource"
-          type: array
-        limit:
-          description: 这一页最多几条，回显请求里的值
-          format: int64
-          type: integer
-        offset:
-          description: 跳过了多少条，回显请求里的值
-          format: int64
-          type: integer
-        total:
-          description: 命中的总条数，不只是这一页
-          format: int64
-          type: integer
-      required:
-        - items
-        - total
-        - limit
-        - offset
-      type: object
-    LengthAwarePageSSHKeyResource:
-      additionalProperties: false
-      properties:
-        items:
-          description: 这一页的内容
-          items:
-            $ref: "#/components/schemas/SSHKeyResource"
-          type: array
-        limit:
-          description: 这一页最多几条，回显请求里的值
-          format: int64
-          type: integer
-        offset:
-          description: 跳过了多少条，回显请求里的值
-          format: int64
-          type: integer
-        total:
-          description: 命中的总条数，不只是这一页
-          format: int64
-          type: integer
-      required:
-        - items
-        - total
-        - limit
-        - offset
-      type: object
-    MemberResource:
-      additionalProperties: false
-      properties:
-        created_at:
-          format: date-time
-          type: string
-        created_by:
-          type: string
-        email:
-          type: string
-        first_name:
-          type: string
-        grant:
-          $ref: "#/components/schemas/GrantResource"
-        last_name:
-          type: string
-        user_id:
-          type: string
-      required:
-        - user_id
-        - email
-        - first_name
-        - last_name
-        - grant
-        - created_by
-        - created_at
-      type: object
-    MembershipResource:
-      additionalProperties: false
-      properties:
-        grant:
-          $ref: "#/components/schemas/GrantResource"
-        member:
-          type: boolean
-        project_status:
-          type: string
-        user_status:
-          type: string
-      required:
-        - member
-        - grant
-        - user_status
-        - project_status
-      type: object
-    OwnershipTransferResponseBody:
-      additionalProperties: false
-      properties:
-        from:
-          $ref: "#/components/schemas/MemberResource"
-          description: 原所有者。他保留其余的角色——转让的是所有权，不是把人踢出去
-        to:
-          $ref: "#/components/schemas/MemberResource"
-      required:
-        - from
-        - to
-      type: object
-    PermissionListResponseBody:
-      additionalProperties: false
-      properties:
-        items:
-          items:
-            $ref: "#/components/schemas/PermissionResource"
-          type:
-            - array
-            - "null"
-      required:
-        - items
-      type: object
-    PermissionResource:
-      additionalProperties: false
-      properties:
-        description:
-          type: string
-        name:
-          type: string
-        owner_only:
-          description: 只有项目所有者能做，绑到自定义角色上也不会生效
-          type: boolean
-      required:
-        - name
-        - description
-        - owner_only
-      type: object
-    ProjectAccessResource:
-      additionalProperties: false
-      properties:
-        grant:
-          $ref: "#/components/schemas/GrantResource"
-        project:
-          $ref: "#/components/schemas/ProjectResource"
-      required:
-        - project
-        - grant
-      type: object
-    ProjectResource:
-      additionalProperties: false
-      properties:
-        ban_reason:
-          type: string
-        created_at:
-          format: date-time
-          type: string
-        created_by:
-          type: string
-        deleted_at:
-          description: 盖上墓碑的那一刻
-          format: date-time
-          type:
-            - string
-            - "null"
-        description:
-          type: string
-        id:
-          format: uuid
-          type: string
-        name:
-          type: string
-        overdue_at:
-          description: 欠费的起始时间
-          format: date-time
-          type:
-            - string
-            - "null"
-        status:
-          enum:
-            - ACTIVE
-            - SUSPENDED
-            - BANNED
-            - DELETING
-            - DELETED
-          type: string
-        status_reason:
-          description: 给人看的，不参与任何查询
-          type: string
-        updated_at:
-          format: date-time
-          type: string
-      required:
-        - id
-        - name
-        - description
-        - status
-        - status_reason
-        - ban_reason
-        - overdue_at
-        - deleted_at
-        - created_by
-        - created_at
-        - updated_at
-      type: object
-    ProjectTokenResponseBody:
-      additionalProperties: false
-      properties:
-        expires_at:
-          description: 过期时刻。到点之前拿用户身份再换一张，别等第一个 401
-          format: date-time
-          type: string
-        expires_in:
-          description: 还能活多少秒
-          format: int64
-          type: integer
-        grant:
-          $ref: "#/components/schemas/GrantResource"
-          description: "**这一份是此刻的快照，不在令牌里，也不要缓存它。** 它只用来决定界面上画什么；真正的判定每次都要重新问"
-        project:
-          $ref: "#/components/schemas/ProjectResource"
-          description: 顺带带上项目本身，省掉换完之后立刻再查一次
-        token:
-          description: "项目令牌，放进 Authorization: Bearer 里用"
-          type: string
-        token_type:
-          description: 固定是 Bearer
-          type: string
-      required:
-        - token
-        - token_type
-        - expires_at
-        - expires_in
-        - project
-        - grant
-      type: object
-    RegisterRequestBody:
-      additionalProperties: false
-      properties:
-        consents:
-          description: 当前生效的必签文件全部要在里面，版本号要和 GET /api/v1/agreements 给的一致
-          items:
-            $ref: "#/components/schemas/ConsentBody"
-          type:
-            - array
-            - "null"
-      required:
-        - consents
-      type: object
-    RenameSSHKeyRequestBody:
-      additionalProperties: false
-      properties:
-        name:
-          maxLength: 128
-          type: string
-      required:
-        - name
-      type: object
-    RoleListResponseBody:
-      additionalProperties: false
-      properties:
-        items:
-          items:
-            $ref: "#/components/schemas/RoleResource"
-          type:
-            - array
-            - "null"
-      required:
-        - items
-      type: object
-    RoleResource:
-      additionalProperties: false
-      properties:
-        builtin:
-          description: 内置角色不可删、不可改权限：OWNER 和 ADMIN 的语义写在代码里
-          type: boolean
-        code:
-          type: string
-        created_at:
-          format: date-time
-          type: string
-        description:
-          type: string
-        name:
-          type: string
-        permissions:
-          items:
-            type: string
-          type:
-            - array
-            - "null"
-        updated_at:
-          format: date-time
-          type: string
-      required:
-        - code
-        - name
-        - description
-        - builtin
-        - permissions
-        - created_at
-        - updated_at
-      type: object
-    SSHKeyResource:
-      additionalProperties: false
-      properties:
-        created_at:
-          format: date-time
-          type: string
-        fingerprint:
-          type: string
-        has_private_key:
-          description: 平台生成并保管的那把。它的私钥不对外提供
-          type: boolean
-        id:
-          format: uuid
-          type: string
-        key_type:
-          type: string
-        name:
-          type: string
-        owner_user_id:
-          description: 归属人；不给表示这把钥匙归项目本身
-          type: string
-        public_key:
-          type: string
-        purposes:
-          description: 用途标签。平台自己生成的那把是 platform
-          items:
-            type: string
-          type:
-            - array
-            - "null"
-        status:
-          enum:
-            - ACTIVE
-            - REVOKED
-          type: string
-      required:
-        - id
-        - name
-        - public_key
-        - fingerprint
-        - key_type
-        - status
-        - created_at
-        - purposes
-        - has_private_key
-      type: object
-    SetMemberRolesRequestBody:
-      additionalProperties: false
-      properties:
-        roles:
-          description: 这个人应当持有的**全部**角色编码。OWNER 不能出现在这里
-          items:
-            type: string
-          type:
-            - array
-            - "null"
-      required:
-        - roles
-      type: object
-    SubmitIdentityVerificationRequestBody:
-      additionalProperties: false
-      properties:
-        id_number:
-          description: 证件号码。同上，而且同一个号码不能挂在两个账号上
-          maxLength: 64
-          minLength: 6
-          type: string
-        real_name:
-          description: 真实姓名。敏感个人信息，加密入库，任何接口都不会再把它读出来
-          maxLength: 128
-          type: string
-      required:
-        - real_name
-        - id_number
-      type: object
-    TransferOwnershipRequestBody:
-      additionalProperties: false
-      properties:
-        to_user_id:
-          description: 接手的人必须已经是这个项目的成员
-          maxLength: 255
-          type: string
-      required:
-        - to_user_id
-      type: object
-    UpdateProjectRequestBody:
-      additionalProperties: false
-      properties:
-        description:
-          maxLength: 2000
-          type: string
-        name:
-          maxLength: 128
-          type: string
-      type: object
-    UpdateRoleRequestBody:
-      additionalProperties: false
-      properties:
-        description:
-          maxLength: 255
-          type: string
-        name:
-          maxLength: 64
-          type: string
-        permissions:
-          items:
-            type: string
-          type:
-            - array
-            - "null"
-      required:
-        - name
-      type: object
-  securitySchemes:
-    bearerAuth:
-      bearerFormat: JWT
-      description: 项目令牌。先在 auth.leaflow.net 登录拿到账号令牌，再用它向 IAM 换取项目令牌（POST /api/v1/projects/{projectId}/token）——一张项目令牌同时说明当前用户和当前项目。
-      scheme: bearer
-      type: http
-info:
-  description: |-
-    用户和项目自己用的接口：账号、项目、成员、角色、邀请、SSH 公钥。
-
-    ## 两种令牌
-
-    1. 在 auth.leaflow.net 登录，拿到**账号令牌**；
-    2. 带着它调 `GET /api/v1/projects` 列出参与的项目。首次调用会自动登记账号，姓名与邮箱取自登录信息；
-    3. 选定项目后调 `POST /api/v1/projects/{projectId}/token` 换取**项目令牌**，后续请求一律使用它。
-
-    两种令牌都放在 `Authorization: Bearer` 里。
-
-    项目令牌过期后重新执行第 3 步；账号令牌过期则先在 auth.leaflow.net 续期。没有单独的项目令牌续期接口。
-
-    ## 成员关系只给事实
-
-    `GET /projects/{projectId}/membership` 返回的是这个人在项目里持有哪些角色和权限，不返回「能否执行某个操作」的结论——那需要一份「哪个操作要哪条权限」的对照表，而它由各个服务分别声明。
-  title: Leaflow IAM 用户 API
-  version: 1.0.0
-openapi: 3.1.0
-paths:
-  /api/v1/agreements:
-    get:
-      description: |-
-        注册页显示它，用户同意之后把每一项的 `type` 和 `version` 原样回传给 `POST /api/v1/register`。
-
-        不需要令牌。还没有任何文件生效时返回空数组，那时注册不需要提交 `consents`。
-      operationId: list-agreements
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/AgreementListResponseBody"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 列出注册必须同意的文件
-      tags:
-        - Agreement
-  /api/v1/me:
-    get:
-      description: "`pending_agreements` 是还没同意的文件，非空就要先引导用户同意，再调 `POST /api/v1/me/consents`。"
-      operationId: get-account
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/AccountResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 查看当前账号
-      tags:
-        - Account
-  /api/v1/me/consents:
-    get:
-      description: 全部记录，最新的在前，包括已经不是当前版本的那些。
-      operationId: list-consents
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/ConsentListResponseBody"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 列出我同意过的文件
-      tags:
-        - Agreement
-    post:
-      description: |-
-        条款改版之后用它重新同意，`GET /api/v1/me` 的 `pending_agreements` 非空时就该调。
-
-        只收当前生效的版本，签旧版答 409。重复提交同一版不报错，第一次那条记录会留着。
-      operationId: accept-agreements
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/AcceptConsentsRequestBody"
-        required: true
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/AccountResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 同意条款
-      tags:
-        - Agreement
-  /api/v1/me/identity-verification:
-    get:
-      description: 没交过材料时答 UNVERIFIED，不是 404。姓名和证件号不会出现在任何响应里。
-      operationId: get-identity-verification
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/IdentityVerificationResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 查看实名核验状态
-      tags:
-        - Account
-    post:
-      description: 已经在等人审的和已经核过的都会被拒。被驳回之后可以改了再交。
-      operationId: submit-identity-verification
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/SubmitIdentityVerificationRequestBody"
-        required: true
-      responses:
-        "202":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/IdentityVerificationResource"
-          description: Accepted
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 提交实名核验材料
-      tags:
-        - Account
-  /api/v1/me/invitations:
-    get:
-      description: 按当前账号的邮箱查，因为要约是寄给一个地址的——被邀请的人当时可能还没注册。
-      operationId: list-my-invitations
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - description: 这一页最多返回多少条
-          explode: false
-          in: query
-          name: limit
-          schema:
-            default: 50
-            description: 这一页最多返回多少条
-            format: int64
-            maximum: 200
-            minimum: 1
-            type: integer
-        - description: 跳过多少条。要翻得更深请改用游标翻页的接口
-          explode: false
-          in: query
-          name: offset
-          schema:
-            description: 跳过多少条。要翻得更深请改用游标翻页的接口
-            format: int64
-            maximum: 10000
-            minimum: 0
-            type: integer
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/LengthAwarePageInvitationResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 列出寄给我的要约
-      tags:
-        - Invitation
-  /api/v1/me/invitations/accept:
-    post:
-      description: token 对不上和这份要约已经不作数了是同一个回答：持有者对这两种情况能做的事完全一样，分开报会把这个接口变成一个可以拿来试 token 的探针。
-      operationId: accept-invitation-by-token
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/AcceptInvitationByTokenRequestBody"
-        required: true
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/AcceptedInvitationResponseBody"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 顺着邀请链接接受
-      tags:
-        - Invitation
-  /api/v1/me/invitations/{invitationId}/accept:
-    post:
-      description: 不需要 token：token 证明的是「你就是这份要约寄给的那个人」，而当前账号的邮箱对得上这份要约，证明的是同一件事。
-      operationId: accept-invitation
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: invitationId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/AcceptedInvitationResponseBody"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 接受一份列在我名下的要约
-      tags:
-        - Invitation
-  /api/v1/permissions:
-    get:
-      description: "**只有 IAM 这一份。** 别的服务的操作不在这里——权限目录是各服务各自声明、由 各个服务自己声明的，IAM 认识它们就等于要跟着每个下游一起发版。"
-      operationId: list-permissions
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/PermissionListResponseBody"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 列出 IAM 自己声明的权限
-      tags:
-        - Project
-  /api/v1/projects:
-    get:
-      description: 默认不含已删除的项目——那些是已经不存在了的东西，要看必须明确用 status=DELETED 点名。
-      operationId: list-projects
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - description: 这一页最多返回多少条
-          explode: false
-          in: query
-          name: limit
-          schema:
-            default: 50
-            description: 这一页最多返回多少条
-            format: int64
-            maximum: 200
-            minimum: 1
-            type: integer
-        - description: 跳过多少条。要翻得更深请改用游标翻页的接口
-          explode: false
-          in: query
-          name: offset
-          schema:
-            description: 跳过多少条。要翻得更深请改用游标翻页的接口
-            format: int64
-            maximum: 10000
-            minimum: 0
-            type: integer
-        - description: 按名称或描述模糊匹配
-          explode: false
-          in: query
-          name: keyword
-          schema:
-            description: 按名称或描述模糊匹配
-            maxLength: 128
-            type: string
-        - description: 按对外状态过滤。不传时不返回已删除的项目
-          explode: false
-          in: query
-          name: status
-          schema:
-            description: 按对外状态过滤。不传时不返回已删除的项目
-            enum:
-              - ACTIVE
-              - SUSPENDED
-              - BANNED
-              - DELETING
-              - DELETED
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/LengthAwarePageProjectAccessResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 列出我参与的项目
-      tags:
-        - Project
-    post:
-      description: 建的人就是所有者。项目会连带预置 OWNER、ADMIN 两个内置角色和一个空权限的 member 角色。
-      operationId: create-project
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/CreateProjectRequestBody"
-        required: true
-      responses:
-        "201":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/ProjectAccessResource"
-          description: Created
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 建一个项目
-      tags:
-        - Project
-  /api/v1/projects/{projectId}:
-    delete:
-      description: 只有所有者能做，而且没有回头路：项目进入 DELETING，各服务开始清掉它下面的资源。项目行本身永远留着——查一个删掉的项目查得到，答案是它没了，而不是一个 404。
-      operationId: delete-project
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/ProjectAccessResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 删除项目
-      tags:
-        - Project
-    get:
-      description: 在项目里就看得到，不需要额外的读权限。
-      operationId: get-project
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/ProjectAccessResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 查看一个项目
-      tags:
-        - Project
-    patch:
-      operationId: update-project
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/UpdateProjectRequestBody"
-        required: true
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/ProjectAccessResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 改项目的名称与描述
-      tags:
-        - Project
-  /api/v1/projects/{projectId}/invitations:
-    get:
-      description: 在项目里就看得到，和成员列表同一条规则：谁被请了也是「这个项目有谁」的一部分。
-      operationId: list-project-invitations
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - description: 这一页最多返回多少条
-          explode: false
-          in: query
-          name: limit
-          schema:
-            default: 50
-            description: 这一页最多返回多少条
-            format: int64
-            maximum: 200
-            minimum: 1
-            type: integer
-        - description: 跳过多少条。要翻得更深请改用游标翻页的接口
-          explode: false
-          in: query
-          name: offset
-          schema:
-            description: 跳过多少条。要翻得更深请改用游标翻页的接口
-            format: int64
-            maximum: 10000
-            minimum: 0
-            type: integer
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/LengthAwarePageInvitationResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 列出这个项目还在等的要约
-      tags:
-        - Invitation
-    post:
-      description: 要约站 14 天。有上限是因为里面那些角色是按发出那一刻的项目校验的，一份活得比它所依据的安排还久的要约会授出现在没人打算授的权限。
-      operationId: issue-invitation
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/IssueInvitationRequestBody"
-        required: true
-      responses:
-        "201":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/IssuedInvitationResponseBody"
-          description: Created
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 发出一份邀请
-      tags:
-        - Invitation
-  /api/v1/projects/{projectId}/invitations/{invitationId}:
-    delete:
-      operationId: revoke-invitation
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-        - in: path
-          name: invitationId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      responses:
-        "204":
-          description: No Content
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 撤回一份还没被兑现的要约
-      tags:
-        - Invitation
-  /api/v1/projects/{projectId}/members:
-    get:
-      operationId: list-members
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - description: 这一页最多返回多少条
-          explode: false
-          in: query
-          name: limit
-          schema:
-            default: 50
-            description: 这一页最多返回多少条
-            format: int64
-            maximum: 200
-            minimum: 1
-            type: integer
-        - description: 跳过多少条。要翻得更深请改用游标翻页的接口
-          explode: false
-          in: query
-          name: offset
-          schema:
-            description: 跳过多少条。要翻得更深请改用游标翻页的接口
-            format: int64
-            maximum: 10000
-            minimum: 0
-            type: integer
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-        - description: 按用户 ID、邮箱或姓名模糊匹配
-          explode: false
-          in: query
-          name: keyword
-          schema:
-            description: 按用户 ID、邮箱或姓名模糊匹配
-            maxLength: 255
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/LengthAwarePageMemberResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 列出项目成员
-      tags:
-        - Member
-  /api/v1/projects/{projectId}/members/{userId}:
-    delete:
-      description: 移除别人要 iam:members.manage；退出只要求自己在这个项目里——任何人都可能被拉进一个项目，那么任何人就得能出去。所有者两条路都不行，先转移所有权。
-      operationId: remove-member
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-        - in: path
-          name: userId
-          required: true
-          schema:
-            maxLength: 255
-            type: string
-      responses:
-        "204":
-          description: No Content
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 移除成员，或者自己退出
-      tags:
-        - Member
-  /api/v1/projects/{projectId}/members/{userId}/roles:
-    put:
-      description: 整体替换而不是增删：调用方拿到的就是一份完整清单，让它自己算差集只会让「我以为我取消了那个角色」这种事变得可能。所有者身上的 OWNER 不受影响。
-      operationId: set-member-roles
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-        - in: path
-          name: userId
-          required: true
-          schema:
-            maxLength: 255
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/SetMemberRolesRequestBody"
-        required: true
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/MemberResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 设置一个成员持有的角色
-      tags:
-        - Member
-  /api/v1/projects/{projectId}/membership:
-    get:
-      description: 只给事实，不给结论：这里没有 allowed，因为 IAM 不知道你要做的是哪个操作——哪个操作需要哪条权限那份目录属于各个服务，判断在它们那边。
-      operationId: get-project-membership
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/MembershipResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 查看我在这个项目里的身份
-      tags:
-        - Project
-  /api/v1/projects/{projectId}/roles:
-    get:
-      operationId: list-roles
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/RoleListResponseBody"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 列出项目里的角色
-      tags:
-        - Role
-    post:
-      operationId: create-role
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/CreateRoleRequestBody"
-        required: true
-      responses:
-        "201":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/RoleResource"
-          description: Created
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 建一个角色
-      tags:
-        - Role
-  /api/v1/projects/{projectId}/roles/{code}:
-    delete:
-      description: 还有人持有时会被拒。级联摘掉那些绑定等于把每个持有者悄悄降级——请求里没有一个字说了这件事，事后也查不到。
-      operationId: delete-role
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-        - in: path
-          name: code
-          required: true
-          schema:
-            maxLength: 64
-            type: string
-      responses:
-        "204":
-          description: No Content
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 删一个角色
-      tags:
-        - Role
-    get:
-      operationId: get-role
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-        - in: path
-          name: code
-          required: true
-          schema:
-            maxLength: 64
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/RoleResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 查看一个角色
-      tags:
-        - Role
-    put:
-      description: 名称、描述和权限整体替换。改完会在同一个事务里重新编译持有它的每一个成员——角色的权限变了，就是那些人的权限变了，而下一次请求是拿编译结果判定的。
-      operationId: update-role
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-        - in: path
-          name: code
-          required: true
-          schema:
-            maxLength: 64
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/UpdateRoleRequestBody"
-        required: true
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/RoleResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 改一个角色
-      tags:
-        - Role
-  /api/v1/projects/{projectId}/ssh-keys:
-    get:
-      description: 归成员的和归项目的都在里面，靠每一条上的 owner_user_id 区分。
-      operationId: list-ssh-keys
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - description: 这一页最多返回多少条
-          explode: false
-          in: query
-          name: limit
-          schema:
-            default: 50
-            description: 这一页最多返回多少条
-            format: int64
-            maximum: 200
-            minimum: 1
-            type: integer
-        - description: 跳过多少条。要翻得更深请改用游标翻页的接口
-          explode: false
-          in: query
-          name: offset
-          schema:
-            description: 跳过多少条。要翻得更深请改用游标翻页的接口
-            format: int64
-            maximum: 10000
-            minimum: 0
-            type: integer
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-        - description: 不传时两种都返回
-          explode: false
-          in: query
-          name: status
-          schema:
-            description: 不传时两种都返回
-            enum:
-              - ACTIVE
-              - REVOKED
-            type: string
-        - description: 只列挂着这个用途的钥匙。平台自己生成的那把是 platform
-          explode: false
-          in: query
-          name: purpose
-          schema:
-            description: 只列挂着这个用途的钥匙。平台自己生成的那把是 platform
-            maxLength: 64
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/LengthAwarePageSSHKeyResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 列出这个项目的公钥
-      tags:
-        - SSHKey
-    post:
-      description: owner=me 是自己的，是成员就能加；owner=project 是项目公用的，要 iam:ssh_keys.manage —— 它会进这个项目之后开出来的每一台机器。
-      operationId: create-ssh-key
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/CreateSSHKeyRequestBody"
-        required: true
-      responses:
-        "201":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/SSHKeyResource"
-          description: Created
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 添加一把公钥
-      tags:
-        - SSHKey
-  /api/v1/projects/{projectId}/ssh-keys/{keyId}:
-    delete:
-      description: 行留着，状态变成 REVOKED。事故之后要问的是当时信任的是哪把钥匙。
-      operationId: revoke-ssh-key
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-        - in: path
-          name: keyId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/SSHKeyResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 吊销一把公钥
-      tags:
-        - SSHKey
-    get:
-      operationId: get-ssh-key
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-        - in: path
-          name: keyId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/SSHKeyResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 查看一把公钥
-      tags:
-        - SSHKey
-    patch:
-      description: 只有名字能改：公钥、类型、指纹是同一样东西的三种说法，改其中一个会让这一行描述一把并不存在的钥匙。
-      operationId: rename-ssh-key
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-        - in: path
-          name: keyId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/RenameSSHKeyRequestBody"
-        required: true
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/SSHKeyResource"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 给公钥改名
-      tags:
-        - SSHKey
-  /api/v1/projects/{projectId}/token:
-    post:
-      description: |-
-        选定一个项目后，用账号令牌换取该项目的令牌。
-
-        **只接受 auth.leaflow.net 签发的账号令牌，不接受项目令牌。** 项目令牌过期后，先在 auth.leaflow.net 续期账号令牌，再重新调用这个接口。
-
-        换取时会确认账号可用、项目存在，且**调用者是该项目的成员**。非成员无法换取。
-
-        令牌只表明身份（用户与项目），**不包含权限**：权限在每次请求时实时判定，所以角色调整立即生效，不必等待令牌过期。
-
-        项目处于停用、封禁或删除中时**仍可换取令牌**：这些状态限制的是写入，不影响查看项目当前状况。
-      operationId: exchange-project-token
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      responses:
-        "201":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/ProjectTokenResponseBody"
-          description: Created
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 换一张项目令牌
-      tags:
-        - ProjectToken
-  /api/v1/projects/{projectId}/transfer-ownership:
-    post:
-      description: OWNER 唯一的移动方式，只有所有者本人能发起——能像普通角色那样授予的话，任何管理员都可以顺手把自己变成所有者。
-      operationId: transfer-project-ownership
-      parameters:
-        - description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: Bearer 令牌。选定项目之前用 auth.leaflow.net 签发的账号令牌，选定之后用项目令牌
-            type: string
-        - in: path
-          name: projectId
-          required: true
-          schema:
-            format: uuid
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/TransferOwnershipRequestBody"
-        required: true
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/OwnershipTransferResponseBody"
-          description: OK
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 转移项目所有权
-      tags:
-        - Member
-  /api/v1/register:
-    post:
-      description: |-
-        在 auth.leaflow.net 登录之后调它，带上账号令牌。姓名和邮箱取自登录信息，不从请求体收。
-
-        `consents` 要覆盖 `GET /api/v1/agreements` 返回的每一份，版本号也要一致；漏一份答 400，版本对不上答 409（多半是页面开着的时候条款改版了，重新拉一次清单即可）。已经注册过的答 409。
-      operationId: register
-      parameters:
-        - description: auth.leaflow.net 签发的账号令牌，形如 Bearer <token>
-          in: header
-          name: Authorization
-          required: true
-          schema:
-            description: auth.leaflow.net 签发的账号令牌，形如 Bearer <token>
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/RegisterRequestBody"
-        required: true
-      responses:
-        "201":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/AccountResource"
-          description: Created
-        default:
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Error"
-          description: Error
-      summary: 注册账号
-      tags:
-        - Account
-security:
-  - bearerAuth: []
-