zuplo 6.72.2 → 6.72.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/docs/articles/accounts/audit-logs.mdx +4 -4
- package/docs/articles/audit-logging.mdx +65 -0
- package/docs/articles/audit-logs.mdx +222 -0
- package/docs/articles/{custom-audit-log-policy.mdx → custom-audit-logs.mdx} +26 -22
- package/docs/policies/_index.md +1 -0
- package/docs/policies/audit-log-inbound/doc.md +16 -11
- package/docs/policies/authzen-inbound/schema.json +1 -1
- package/docs/policies/axiomatics-authz-inbound/schema.json +1 -1
- package/docs/policies/mtls-auth-inbound/intro.md +52 -5
- package/docs/policies/okta-fga-authz-inbound/schema.json +1 -1
- package/docs/policies/openfga-authz-inbound/schema.json +1 -1
- package/docs/policies/require-user-claims-inbound/doc.md +120 -0
- package/docs/policies/require-user-claims-inbound/intro.md +9 -0
- package/docs/policies/require-user-claims-inbound/schema.json +1323 -0
- package/docs/policies/semantic-cache-inbound/schema.json +1 -1
- package/docs/policies/upstream-gcp-federated-auth-inbound/schema.json +1 -1
- package/docs/programmable-api/overview.mdx +0 -7
- package/package.json +4 -4
- package/docs/programmable-api/audit-log.mdx +0 -74
|
@@ -0,0 +1,1323 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://json-schema.org/draft-07/schema",
|
|
3
|
+
"$id": "https://cdn.zuplo.com/policies/runtime/schemas/require-user-claims-inbound.json",
|
|
4
|
+
"type": "object",
|
|
5
|
+
"title": "Require User Claims",
|
|
6
|
+
"isDeprecated": false,
|
|
7
|
+
"isPaidAddOn": false,
|
|
8
|
+
"isEnterprise": false,
|
|
9
|
+
"isInternal": false,
|
|
10
|
+
"isBeta": false,
|
|
11
|
+
"isHidden": false,
|
|
12
|
+
"requiresAI": false,
|
|
13
|
+
"products": ["api-gateway"],
|
|
14
|
+
"description": "Authorizes requests by validating claims on the authenticated user (`request.user`) against a configurable rule of `and`/`or` combinators and per-claim `eq`, `in`, and `startsWith` checks. Run it after any authentication policy that populates `request.user` — a JWT auth policy, API key auth, mTLS, and so on — to allow only specific callers (service accounts, OAuth clients, tenants, groups) without writing custom code.\n\nEvery check fails closed: a missing or non-primitive claim never matches, comparisons are strict and type-sensitive, and requests without an authenticated user receive a 401 response. Denied requests receive a 403 response that does not echo claim values or expected values; the failing checks are written to the request log instead.\n\nValidation of the options runs lazily inside the policy constructor, which the runtime caches per policy name. Misconfigured options therefore fail on first use with a customer-facing `ConfigurationError` instead of failing at module load.",
|
|
15
|
+
"deprecatedMessage": "",
|
|
16
|
+
"required": ["handler"],
|
|
17
|
+
"properties": {
|
|
18
|
+
"handler": {
|
|
19
|
+
"type": "object",
|
|
20
|
+
"default": {},
|
|
21
|
+
"required": ["export", "module", "options"],
|
|
22
|
+
"properties": {
|
|
23
|
+
"export": {
|
|
24
|
+
"const": "RequireUserClaimsInboundPolicy",
|
|
25
|
+
"description": "The name of the exported type"
|
|
26
|
+
},
|
|
27
|
+
"module": {
|
|
28
|
+
"const": "$import(@zuplo/runtime)",
|
|
29
|
+
"description": "The module containing the policy"
|
|
30
|
+
},
|
|
31
|
+
"options": {
|
|
32
|
+
"title": "RequireUserClaimsInboundPolicyOptions",
|
|
33
|
+
"type": "object",
|
|
34
|
+
"description": "The options for this policy.",
|
|
35
|
+
"additionalProperties": false,
|
|
36
|
+
"required": ["rule"],
|
|
37
|
+
"properties": {
|
|
38
|
+
"rule": {
|
|
39
|
+
"description": "The authorization rule evaluated against the authenticated user's claims (request.user.data, populated by the authentication policy that runs before this one — a JWT policy, API key auth, mTLS, etc.). A rule is either a single claim check (eq, in, or startsWith) or an and/or combination of nested rules. Combinators may nest up to three levels deep. Requests that fail the rule receive a 403 Forbidden response.",
|
|
40
|
+
"oneOf": [
|
|
41
|
+
{
|
|
42
|
+
"type": "object",
|
|
43
|
+
"additionalProperties": false,
|
|
44
|
+
"required": ["and"],
|
|
45
|
+
"properties": {
|
|
46
|
+
"and": {
|
|
47
|
+
"type": "array",
|
|
48
|
+
"minItems": 1,
|
|
49
|
+
"items": {
|
|
50
|
+
"description": "A second-level rule: a single claim check or an and/or combination of third-level rules.",
|
|
51
|
+
"oneOf": [
|
|
52
|
+
{
|
|
53
|
+
"type": "object",
|
|
54
|
+
"additionalProperties": false,
|
|
55
|
+
"required": ["and"],
|
|
56
|
+
"properties": {
|
|
57
|
+
"and": {
|
|
58
|
+
"type": "array",
|
|
59
|
+
"minItems": 1,
|
|
60
|
+
"items": {
|
|
61
|
+
"description": "A third-level rule: a single claim check or an and/or combination of claim checks. Combinators cannot nest any deeper.",
|
|
62
|
+
"oneOf": [
|
|
63
|
+
{
|
|
64
|
+
"type": "object",
|
|
65
|
+
"additionalProperties": false,
|
|
66
|
+
"required": ["and"],
|
|
67
|
+
"properties": {
|
|
68
|
+
"and": {
|
|
69
|
+
"type": "array",
|
|
70
|
+
"minItems": 1,
|
|
71
|
+
"items": {
|
|
72
|
+
"description": "A single claim check using exactly one operator: eq, in, or startsWith.",
|
|
73
|
+
"oneOf": [
|
|
74
|
+
{
|
|
75
|
+
"type": "object",
|
|
76
|
+
"additionalProperties": false,
|
|
77
|
+
"required": ["claim", "eq"],
|
|
78
|
+
"properties": {
|
|
79
|
+
"claim": {
|
|
80
|
+
"type": "string",
|
|
81
|
+
"minLength": 1,
|
|
82
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
83
|
+
},
|
|
84
|
+
"eq": {
|
|
85
|
+
"type": [
|
|
86
|
+
"string",
|
|
87
|
+
"number",
|
|
88
|
+
"boolean"
|
|
89
|
+
],
|
|
90
|
+
"description": "The exact value the claim must equal. Comparison is strict and type-sensitive: the string '42' does not equal the number 42. When the claim value is an array, the check passes if any element equals this value."
|
|
91
|
+
}
|
|
92
|
+
}
|
|
93
|
+
},
|
|
94
|
+
{
|
|
95
|
+
"type": "object",
|
|
96
|
+
"additionalProperties": false,
|
|
97
|
+
"required": ["claim", "in"],
|
|
98
|
+
"properties": {
|
|
99
|
+
"claim": {
|
|
100
|
+
"type": "string",
|
|
101
|
+
"minLength": 1,
|
|
102
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
103
|
+
},
|
|
104
|
+
"in": {
|
|
105
|
+
"type": "array",
|
|
106
|
+
"minItems": 1,
|
|
107
|
+
"items": {
|
|
108
|
+
"type": [
|
|
109
|
+
"string",
|
|
110
|
+
"number",
|
|
111
|
+
"boolean"
|
|
112
|
+
]
|
|
113
|
+
},
|
|
114
|
+
"description": "Allowed values for the claim. The check passes when the claim value equals any listed value (strict, type-sensitive comparison). When the claim value is an array, the check passes if any element equals any listed value."
|
|
115
|
+
}
|
|
116
|
+
}
|
|
117
|
+
},
|
|
118
|
+
{
|
|
119
|
+
"type": "object",
|
|
120
|
+
"additionalProperties": false,
|
|
121
|
+
"required": [
|
|
122
|
+
"claim",
|
|
123
|
+
"startsWith"
|
|
124
|
+
],
|
|
125
|
+
"properties": {
|
|
126
|
+
"claim": {
|
|
127
|
+
"type": "string",
|
|
128
|
+
"minLength": 1,
|
|
129
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
130
|
+
},
|
|
131
|
+
"startsWith": {
|
|
132
|
+
"type": "string",
|
|
133
|
+
"minLength": 1,
|
|
134
|
+
"description": "The prefix the claim's string value must start with. Non-string claim values never match. Must not be empty — an empty prefix would match every value. When the claim value is an array, the check passes if any string element starts with this prefix."
|
|
135
|
+
}
|
|
136
|
+
}
|
|
137
|
+
}
|
|
138
|
+
]
|
|
139
|
+
},
|
|
140
|
+
"description": "Claim checks that must all pass. The maximum combinator nesting depth is reached, so entries must be single claim checks."
|
|
141
|
+
}
|
|
142
|
+
}
|
|
143
|
+
},
|
|
144
|
+
{
|
|
145
|
+
"type": "object",
|
|
146
|
+
"additionalProperties": false,
|
|
147
|
+
"required": ["or"],
|
|
148
|
+
"properties": {
|
|
149
|
+
"or": {
|
|
150
|
+
"type": "array",
|
|
151
|
+
"minItems": 1,
|
|
152
|
+
"items": {
|
|
153
|
+
"description": "A single claim check using exactly one operator: eq, in, or startsWith.",
|
|
154
|
+
"oneOf": [
|
|
155
|
+
{
|
|
156
|
+
"type": "object",
|
|
157
|
+
"additionalProperties": false,
|
|
158
|
+
"required": ["claim", "eq"],
|
|
159
|
+
"properties": {
|
|
160
|
+
"claim": {
|
|
161
|
+
"type": "string",
|
|
162
|
+
"minLength": 1,
|
|
163
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
164
|
+
},
|
|
165
|
+
"eq": {
|
|
166
|
+
"type": [
|
|
167
|
+
"string",
|
|
168
|
+
"number",
|
|
169
|
+
"boolean"
|
|
170
|
+
],
|
|
171
|
+
"description": "The exact value the claim must equal. Comparison is strict and type-sensitive: the string '42' does not equal the number 42. When the claim value is an array, the check passes if any element equals this value."
|
|
172
|
+
}
|
|
173
|
+
}
|
|
174
|
+
},
|
|
175
|
+
{
|
|
176
|
+
"type": "object",
|
|
177
|
+
"additionalProperties": false,
|
|
178
|
+
"required": ["claim", "in"],
|
|
179
|
+
"properties": {
|
|
180
|
+
"claim": {
|
|
181
|
+
"type": "string",
|
|
182
|
+
"minLength": 1,
|
|
183
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
184
|
+
},
|
|
185
|
+
"in": {
|
|
186
|
+
"type": "array",
|
|
187
|
+
"minItems": 1,
|
|
188
|
+
"items": {
|
|
189
|
+
"type": [
|
|
190
|
+
"string",
|
|
191
|
+
"number",
|
|
192
|
+
"boolean"
|
|
193
|
+
]
|
|
194
|
+
},
|
|
195
|
+
"description": "Allowed values for the claim. The check passes when the claim value equals any listed value (strict, type-sensitive comparison). When the claim value is an array, the check passes if any element equals any listed value."
|
|
196
|
+
}
|
|
197
|
+
}
|
|
198
|
+
},
|
|
199
|
+
{
|
|
200
|
+
"type": "object",
|
|
201
|
+
"additionalProperties": false,
|
|
202
|
+
"required": [
|
|
203
|
+
"claim",
|
|
204
|
+
"startsWith"
|
|
205
|
+
],
|
|
206
|
+
"properties": {
|
|
207
|
+
"claim": {
|
|
208
|
+
"type": "string",
|
|
209
|
+
"minLength": 1,
|
|
210
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
211
|
+
},
|
|
212
|
+
"startsWith": {
|
|
213
|
+
"type": "string",
|
|
214
|
+
"minLength": 1,
|
|
215
|
+
"description": "The prefix the claim's string value must start with. Non-string claim values never match. Must not be empty — an empty prefix would match every value. When the claim value is an array, the check passes if any string element starts with this prefix."
|
|
216
|
+
}
|
|
217
|
+
}
|
|
218
|
+
}
|
|
219
|
+
]
|
|
220
|
+
},
|
|
221
|
+
"description": "Claim checks of which at least one must pass. The maximum combinator nesting depth is reached, so entries must be single claim checks."
|
|
222
|
+
}
|
|
223
|
+
}
|
|
224
|
+
},
|
|
225
|
+
{
|
|
226
|
+
"type": "object",
|
|
227
|
+
"additionalProperties": false,
|
|
228
|
+
"required": ["claim", "eq"],
|
|
229
|
+
"properties": {
|
|
230
|
+
"claim": {
|
|
231
|
+
"type": "string",
|
|
232
|
+
"minLength": 1,
|
|
233
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
234
|
+
},
|
|
235
|
+
"eq": {
|
|
236
|
+
"type": [
|
|
237
|
+
"string",
|
|
238
|
+
"number",
|
|
239
|
+
"boolean"
|
|
240
|
+
],
|
|
241
|
+
"description": "The exact value the claim must equal. Comparison is strict and type-sensitive: the string '42' does not equal the number 42. When the claim value is an array, the check passes if any element equals this value."
|
|
242
|
+
}
|
|
243
|
+
}
|
|
244
|
+
},
|
|
245
|
+
{
|
|
246
|
+
"type": "object",
|
|
247
|
+
"additionalProperties": false,
|
|
248
|
+
"required": ["claim", "in"],
|
|
249
|
+
"properties": {
|
|
250
|
+
"claim": {
|
|
251
|
+
"type": "string",
|
|
252
|
+
"minLength": 1,
|
|
253
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
254
|
+
},
|
|
255
|
+
"in": {
|
|
256
|
+
"type": "array",
|
|
257
|
+
"minItems": 1,
|
|
258
|
+
"items": {
|
|
259
|
+
"type": [
|
|
260
|
+
"string",
|
|
261
|
+
"number",
|
|
262
|
+
"boolean"
|
|
263
|
+
]
|
|
264
|
+
},
|
|
265
|
+
"description": "Allowed values for the claim. The check passes when the claim value equals any listed value (strict, type-sensitive comparison). When the claim value is an array, the check passes if any element equals any listed value."
|
|
266
|
+
}
|
|
267
|
+
}
|
|
268
|
+
},
|
|
269
|
+
{
|
|
270
|
+
"type": "object",
|
|
271
|
+
"additionalProperties": false,
|
|
272
|
+
"required": ["claim", "startsWith"],
|
|
273
|
+
"properties": {
|
|
274
|
+
"claim": {
|
|
275
|
+
"type": "string",
|
|
276
|
+
"minLength": 1,
|
|
277
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
278
|
+
},
|
|
279
|
+
"startsWith": {
|
|
280
|
+
"type": "string",
|
|
281
|
+
"minLength": 1,
|
|
282
|
+
"description": "The prefix the claim's string value must start with. Non-string claim values never match. Must not be empty — an empty prefix would match every value. When the claim value is an array, the check passes if any string element starts with this prefix."
|
|
283
|
+
}
|
|
284
|
+
}
|
|
285
|
+
}
|
|
286
|
+
]
|
|
287
|
+
},
|
|
288
|
+
"description": "Nested rules that must all pass."
|
|
289
|
+
}
|
|
290
|
+
}
|
|
291
|
+
},
|
|
292
|
+
{
|
|
293
|
+
"type": "object",
|
|
294
|
+
"additionalProperties": false,
|
|
295
|
+
"required": ["or"],
|
|
296
|
+
"properties": {
|
|
297
|
+
"or": {
|
|
298
|
+
"type": "array",
|
|
299
|
+
"minItems": 1,
|
|
300
|
+
"items": {
|
|
301
|
+
"description": "A third-level rule: a single claim check or an and/or combination of claim checks. Combinators cannot nest any deeper.",
|
|
302
|
+
"oneOf": [
|
|
303
|
+
{
|
|
304
|
+
"type": "object",
|
|
305
|
+
"additionalProperties": false,
|
|
306
|
+
"required": ["and"],
|
|
307
|
+
"properties": {
|
|
308
|
+
"and": {
|
|
309
|
+
"type": "array",
|
|
310
|
+
"minItems": 1,
|
|
311
|
+
"items": {
|
|
312
|
+
"description": "A single claim check using exactly one operator: eq, in, or startsWith.",
|
|
313
|
+
"oneOf": [
|
|
314
|
+
{
|
|
315
|
+
"type": "object",
|
|
316
|
+
"additionalProperties": false,
|
|
317
|
+
"required": ["claim", "eq"],
|
|
318
|
+
"properties": {
|
|
319
|
+
"claim": {
|
|
320
|
+
"type": "string",
|
|
321
|
+
"minLength": 1,
|
|
322
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
323
|
+
},
|
|
324
|
+
"eq": {
|
|
325
|
+
"type": [
|
|
326
|
+
"string",
|
|
327
|
+
"number",
|
|
328
|
+
"boolean"
|
|
329
|
+
],
|
|
330
|
+
"description": "The exact value the claim must equal. Comparison is strict and type-sensitive: the string '42' does not equal the number 42. When the claim value is an array, the check passes if any element equals this value."
|
|
331
|
+
}
|
|
332
|
+
}
|
|
333
|
+
},
|
|
334
|
+
{
|
|
335
|
+
"type": "object",
|
|
336
|
+
"additionalProperties": false,
|
|
337
|
+
"required": ["claim", "in"],
|
|
338
|
+
"properties": {
|
|
339
|
+
"claim": {
|
|
340
|
+
"type": "string",
|
|
341
|
+
"minLength": 1,
|
|
342
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
343
|
+
},
|
|
344
|
+
"in": {
|
|
345
|
+
"type": "array",
|
|
346
|
+
"minItems": 1,
|
|
347
|
+
"items": {
|
|
348
|
+
"type": [
|
|
349
|
+
"string",
|
|
350
|
+
"number",
|
|
351
|
+
"boolean"
|
|
352
|
+
]
|
|
353
|
+
},
|
|
354
|
+
"description": "Allowed values for the claim. The check passes when the claim value equals any listed value (strict, type-sensitive comparison). When the claim value is an array, the check passes if any element equals any listed value."
|
|
355
|
+
}
|
|
356
|
+
}
|
|
357
|
+
},
|
|
358
|
+
{
|
|
359
|
+
"type": "object",
|
|
360
|
+
"additionalProperties": false,
|
|
361
|
+
"required": [
|
|
362
|
+
"claim",
|
|
363
|
+
"startsWith"
|
|
364
|
+
],
|
|
365
|
+
"properties": {
|
|
366
|
+
"claim": {
|
|
367
|
+
"type": "string",
|
|
368
|
+
"minLength": 1,
|
|
369
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
370
|
+
},
|
|
371
|
+
"startsWith": {
|
|
372
|
+
"type": "string",
|
|
373
|
+
"minLength": 1,
|
|
374
|
+
"description": "The prefix the claim's string value must start with. Non-string claim values never match. Must not be empty — an empty prefix would match every value. When the claim value is an array, the check passes if any string element starts with this prefix."
|
|
375
|
+
}
|
|
376
|
+
}
|
|
377
|
+
}
|
|
378
|
+
]
|
|
379
|
+
},
|
|
380
|
+
"description": "Claim checks that must all pass. The maximum combinator nesting depth is reached, so entries must be single claim checks."
|
|
381
|
+
}
|
|
382
|
+
}
|
|
383
|
+
},
|
|
384
|
+
{
|
|
385
|
+
"type": "object",
|
|
386
|
+
"additionalProperties": false,
|
|
387
|
+
"required": ["or"],
|
|
388
|
+
"properties": {
|
|
389
|
+
"or": {
|
|
390
|
+
"type": "array",
|
|
391
|
+
"minItems": 1,
|
|
392
|
+
"items": {
|
|
393
|
+
"description": "A single claim check using exactly one operator: eq, in, or startsWith.",
|
|
394
|
+
"oneOf": [
|
|
395
|
+
{
|
|
396
|
+
"type": "object",
|
|
397
|
+
"additionalProperties": false,
|
|
398
|
+
"required": ["claim", "eq"],
|
|
399
|
+
"properties": {
|
|
400
|
+
"claim": {
|
|
401
|
+
"type": "string",
|
|
402
|
+
"minLength": 1,
|
|
403
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
404
|
+
},
|
|
405
|
+
"eq": {
|
|
406
|
+
"type": [
|
|
407
|
+
"string",
|
|
408
|
+
"number",
|
|
409
|
+
"boolean"
|
|
410
|
+
],
|
|
411
|
+
"description": "The exact value the claim must equal. Comparison is strict and type-sensitive: the string '42' does not equal the number 42. When the claim value is an array, the check passes if any element equals this value."
|
|
412
|
+
}
|
|
413
|
+
}
|
|
414
|
+
},
|
|
415
|
+
{
|
|
416
|
+
"type": "object",
|
|
417
|
+
"additionalProperties": false,
|
|
418
|
+
"required": ["claim", "in"],
|
|
419
|
+
"properties": {
|
|
420
|
+
"claim": {
|
|
421
|
+
"type": "string",
|
|
422
|
+
"minLength": 1,
|
|
423
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
424
|
+
},
|
|
425
|
+
"in": {
|
|
426
|
+
"type": "array",
|
|
427
|
+
"minItems": 1,
|
|
428
|
+
"items": {
|
|
429
|
+
"type": [
|
|
430
|
+
"string",
|
|
431
|
+
"number",
|
|
432
|
+
"boolean"
|
|
433
|
+
]
|
|
434
|
+
},
|
|
435
|
+
"description": "Allowed values for the claim. The check passes when the claim value equals any listed value (strict, type-sensitive comparison). When the claim value is an array, the check passes if any element equals any listed value."
|
|
436
|
+
}
|
|
437
|
+
}
|
|
438
|
+
},
|
|
439
|
+
{
|
|
440
|
+
"type": "object",
|
|
441
|
+
"additionalProperties": false,
|
|
442
|
+
"required": [
|
|
443
|
+
"claim",
|
|
444
|
+
"startsWith"
|
|
445
|
+
],
|
|
446
|
+
"properties": {
|
|
447
|
+
"claim": {
|
|
448
|
+
"type": "string",
|
|
449
|
+
"minLength": 1,
|
|
450
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
451
|
+
},
|
|
452
|
+
"startsWith": {
|
|
453
|
+
"type": "string",
|
|
454
|
+
"minLength": 1,
|
|
455
|
+
"description": "The prefix the claim's string value must start with. Non-string claim values never match. Must not be empty — an empty prefix would match every value. When the claim value is an array, the check passes if any string element starts with this prefix."
|
|
456
|
+
}
|
|
457
|
+
}
|
|
458
|
+
}
|
|
459
|
+
]
|
|
460
|
+
},
|
|
461
|
+
"description": "Claim checks of which at least one must pass. The maximum combinator nesting depth is reached, so entries must be single claim checks."
|
|
462
|
+
}
|
|
463
|
+
}
|
|
464
|
+
},
|
|
465
|
+
{
|
|
466
|
+
"type": "object",
|
|
467
|
+
"additionalProperties": false,
|
|
468
|
+
"required": ["claim", "eq"],
|
|
469
|
+
"properties": {
|
|
470
|
+
"claim": {
|
|
471
|
+
"type": "string",
|
|
472
|
+
"minLength": 1,
|
|
473
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
474
|
+
},
|
|
475
|
+
"eq": {
|
|
476
|
+
"type": [
|
|
477
|
+
"string",
|
|
478
|
+
"number",
|
|
479
|
+
"boolean"
|
|
480
|
+
],
|
|
481
|
+
"description": "The exact value the claim must equal. Comparison is strict and type-sensitive: the string '42' does not equal the number 42. When the claim value is an array, the check passes if any element equals this value."
|
|
482
|
+
}
|
|
483
|
+
}
|
|
484
|
+
},
|
|
485
|
+
{
|
|
486
|
+
"type": "object",
|
|
487
|
+
"additionalProperties": false,
|
|
488
|
+
"required": ["claim", "in"],
|
|
489
|
+
"properties": {
|
|
490
|
+
"claim": {
|
|
491
|
+
"type": "string",
|
|
492
|
+
"minLength": 1,
|
|
493
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
494
|
+
},
|
|
495
|
+
"in": {
|
|
496
|
+
"type": "array",
|
|
497
|
+
"minItems": 1,
|
|
498
|
+
"items": {
|
|
499
|
+
"type": [
|
|
500
|
+
"string",
|
|
501
|
+
"number",
|
|
502
|
+
"boolean"
|
|
503
|
+
]
|
|
504
|
+
},
|
|
505
|
+
"description": "Allowed values for the claim. The check passes when the claim value equals any listed value (strict, type-sensitive comparison). When the claim value is an array, the check passes if any element equals any listed value."
|
|
506
|
+
}
|
|
507
|
+
}
|
|
508
|
+
},
|
|
509
|
+
{
|
|
510
|
+
"type": "object",
|
|
511
|
+
"additionalProperties": false,
|
|
512
|
+
"required": ["claim", "startsWith"],
|
|
513
|
+
"properties": {
|
|
514
|
+
"claim": {
|
|
515
|
+
"type": "string",
|
|
516
|
+
"minLength": 1,
|
|
517
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
518
|
+
},
|
|
519
|
+
"startsWith": {
|
|
520
|
+
"type": "string",
|
|
521
|
+
"minLength": 1,
|
|
522
|
+
"description": "The prefix the claim's string value must start with. Non-string claim values never match. Must not be empty — an empty prefix would match every value. When the claim value is an array, the check passes if any string element starts with this prefix."
|
|
523
|
+
}
|
|
524
|
+
}
|
|
525
|
+
}
|
|
526
|
+
]
|
|
527
|
+
},
|
|
528
|
+
"description": "Nested rules of which at least one must pass."
|
|
529
|
+
}
|
|
530
|
+
}
|
|
531
|
+
},
|
|
532
|
+
{
|
|
533
|
+
"type": "object",
|
|
534
|
+
"additionalProperties": false,
|
|
535
|
+
"required": ["claim", "eq"],
|
|
536
|
+
"properties": {
|
|
537
|
+
"claim": {
|
|
538
|
+
"type": "string",
|
|
539
|
+
"minLength": 1,
|
|
540
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
541
|
+
},
|
|
542
|
+
"eq": {
|
|
543
|
+
"type": ["string", "number", "boolean"],
|
|
544
|
+
"description": "The exact value the claim must equal. Comparison is strict and type-sensitive: the string '42' does not equal the number 42. When the claim value is an array, the check passes if any element equals this value."
|
|
545
|
+
}
|
|
546
|
+
}
|
|
547
|
+
},
|
|
548
|
+
{
|
|
549
|
+
"type": "object",
|
|
550
|
+
"additionalProperties": false,
|
|
551
|
+
"required": ["claim", "in"],
|
|
552
|
+
"properties": {
|
|
553
|
+
"claim": {
|
|
554
|
+
"type": "string",
|
|
555
|
+
"minLength": 1,
|
|
556
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
557
|
+
},
|
|
558
|
+
"in": {
|
|
559
|
+
"type": "array",
|
|
560
|
+
"minItems": 1,
|
|
561
|
+
"items": {
|
|
562
|
+
"type": ["string", "number", "boolean"]
|
|
563
|
+
},
|
|
564
|
+
"description": "Allowed values for the claim. The check passes when the claim value equals any listed value (strict, type-sensitive comparison). When the claim value is an array, the check passes if any element equals any listed value."
|
|
565
|
+
}
|
|
566
|
+
}
|
|
567
|
+
},
|
|
568
|
+
{
|
|
569
|
+
"type": "object",
|
|
570
|
+
"additionalProperties": false,
|
|
571
|
+
"required": ["claim", "startsWith"],
|
|
572
|
+
"properties": {
|
|
573
|
+
"claim": {
|
|
574
|
+
"type": "string",
|
|
575
|
+
"minLength": 1,
|
|
576
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
577
|
+
},
|
|
578
|
+
"startsWith": {
|
|
579
|
+
"type": "string",
|
|
580
|
+
"minLength": 1,
|
|
581
|
+
"description": "The prefix the claim's string value must start with. Non-string claim values never match. Must not be empty — an empty prefix would match every value. When the claim value is an array, the check passes if any string element starts with this prefix."
|
|
582
|
+
}
|
|
583
|
+
}
|
|
584
|
+
}
|
|
585
|
+
]
|
|
586
|
+
},
|
|
587
|
+
"description": "Nested rules that must all pass."
|
|
588
|
+
}
|
|
589
|
+
}
|
|
590
|
+
},
|
|
591
|
+
{
|
|
592
|
+
"type": "object",
|
|
593
|
+
"additionalProperties": false,
|
|
594
|
+
"required": ["or"],
|
|
595
|
+
"properties": {
|
|
596
|
+
"or": {
|
|
597
|
+
"type": "array",
|
|
598
|
+
"minItems": 1,
|
|
599
|
+
"items": {
|
|
600
|
+
"description": "A second-level rule: a single claim check or an and/or combination of third-level rules.",
|
|
601
|
+
"oneOf": [
|
|
602
|
+
{
|
|
603
|
+
"type": "object",
|
|
604
|
+
"additionalProperties": false,
|
|
605
|
+
"required": ["and"],
|
|
606
|
+
"properties": {
|
|
607
|
+
"and": {
|
|
608
|
+
"type": "array",
|
|
609
|
+
"minItems": 1,
|
|
610
|
+
"items": {
|
|
611
|
+
"description": "A third-level rule: a single claim check or an and/or combination of claim checks. Combinators cannot nest any deeper.",
|
|
612
|
+
"oneOf": [
|
|
613
|
+
{
|
|
614
|
+
"type": "object",
|
|
615
|
+
"additionalProperties": false,
|
|
616
|
+
"required": ["and"],
|
|
617
|
+
"properties": {
|
|
618
|
+
"and": {
|
|
619
|
+
"type": "array",
|
|
620
|
+
"minItems": 1,
|
|
621
|
+
"items": {
|
|
622
|
+
"description": "A single claim check using exactly one operator: eq, in, or startsWith.",
|
|
623
|
+
"oneOf": [
|
|
624
|
+
{
|
|
625
|
+
"type": "object",
|
|
626
|
+
"additionalProperties": false,
|
|
627
|
+
"required": ["claim", "eq"],
|
|
628
|
+
"properties": {
|
|
629
|
+
"claim": {
|
|
630
|
+
"type": "string",
|
|
631
|
+
"minLength": 1,
|
|
632
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
633
|
+
},
|
|
634
|
+
"eq": {
|
|
635
|
+
"type": [
|
|
636
|
+
"string",
|
|
637
|
+
"number",
|
|
638
|
+
"boolean"
|
|
639
|
+
],
|
|
640
|
+
"description": "The exact value the claim must equal. Comparison is strict and type-sensitive: the string '42' does not equal the number 42. When the claim value is an array, the check passes if any element equals this value."
|
|
641
|
+
}
|
|
642
|
+
}
|
|
643
|
+
},
|
|
644
|
+
{
|
|
645
|
+
"type": "object",
|
|
646
|
+
"additionalProperties": false,
|
|
647
|
+
"required": ["claim", "in"],
|
|
648
|
+
"properties": {
|
|
649
|
+
"claim": {
|
|
650
|
+
"type": "string",
|
|
651
|
+
"minLength": 1,
|
|
652
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
653
|
+
},
|
|
654
|
+
"in": {
|
|
655
|
+
"type": "array",
|
|
656
|
+
"minItems": 1,
|
|
657
|
+
"items": {
|
|
658
|
+
"type": [
|
|
659
|
+
"string",
|
|
660
|
+
"number",
|
|
661
|
+
"boolean"
|
|
662
|
+
]
|
|
663
|
+
},
|
|
664
|
+
"description": "Allowed values for the claim. The check passes when the claim value equals any listed value (strict, type-sensitive comparison). When the claim value is an array, the check passes if any element equals any listed value."
|
|
665
|
+
}
|
|
666
|
+
}
|
|
667
|
+
},
|
|
668
|
+
{
|
|
669
|
+
"type": "object",
|
|
670
|
+
"additionalProperties": false,
|
|
671
|
+
"required": [
|
|
672
|
+
"claim",
|
|
673
|
+
"startsWith"
|
|
674
|
+
],
|
|
675
|
+
"properties": {
|
|
676
|
+
"claim": {
|
|
677
|
+
"type": "string",
|
|
678
|
+
"minLength": 1,
|
|
679
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
680
|
+
},
|
|
681
|
+
"startsWith": {
|
|
682
|
+
"type": "string",
|
|
683
|
+
"minLength": 1,
|
|
684
|
+
"description": "The prefix the claim's string value must start with. Non-string claim values never match. Must not be empty — an empty prefix would match every value. When the claim value is an array, the check passes if any string element starts with this prefix."
|
|
685
|
+
}
|
|
686
|
+
}
|
|
687
|
+
}
|
|
688
|
+
]
|
|
689
|
+
},
|
|
690
|
+
"description": "Claim checks that must all pass. The maximum combinator nesting depth is reached, so entries must be single claim checks."
|
|
691
|
+
}
|
|
692
|
+
}
|
|
693
|
+
},
|
|
694
|
+
{
|
|
695
|
+
"type": "object",
|
|
696
|
+
"additionalProperties": false,
|
|
697
|
+
"required": ["or"],
|
|
698
|
+
"properties": {
|
|
699
|
+
"or": {
|
|
700
|
+
"type": "array",
|
|
701
|
+
"minItems": 1,
|
|
702
|
+
"items": {
|
|
703
|
+
"description": "A single claim check using exactly one operator: eq, in, or startsWith.",
|
|
704
|
+
"oneOf": [
|
|
705
|
+
{
|
|
706
|
+
"type": "object",
|
|
707
|
+
"additionalProperties": false,
|
|
708
|
+
"required": ["claim", "eq"],
|
|
709
|
+
"properties": {
|
|
710
|
+
"claim": {
|
|
711
|
+
"type": "string",
|
|
712
|
+
"minLength": 1,
|
|
713
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
714
|
+
},
|
|
715
|
+
"eq": {
|
|
716
|
+
"type": [
|
|
717
|
+
"string",
|
|
718
|
+
"number",
|
|
719
|
+
"boolean"
|
|
720
|
+
],
|
|
721
|
+
"description": "The exact value the claim must equal. Comparison is strict and type-sensitive: the string '42' does not equal the number 42. When the claim value is an array, the check passes if any element equals this value."
|
|
722
|
+
}
|
|
723
|
+
}
|
|
724
|
+
},
|
|
725
|
+
{
|
|
726
|
+
"type": "object",
|
|
727
|
+
"additionalProperties": false,
|
|
728
|
+
"required": ["claim", "in"],
|
|
729
|
+
"properties": {
|
|
730
|
+
"claim": {
|
|
731
|
+
"type": "string",
|
|
732
|
+
"minLength": 1,
|
|
733
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
734
|
+
},
|
|
735
|
+
"in": {
|
|
736
|
+
"type": "array",
|
|
737
|
+
"minItems": 1,
|
|
738
|
+
"items": {
|
|
739
|
+
"type": [
|
|
740
|
+
"string",
|
|
741
|
+
"number",
|
|
742
|
+
"boolean"
|
|
743
|
+
]
|
|
744
|
+
},
|
|
745
|
+
"description": "Allowed values for the claim. The check passes when the claim value equals any listed value (strict, type-sensitive comparison). When the claim value is an array, the check passes if any element equals any listed value."
|
|
746
|
+
}
|
|
747
|
+
}
|
|
748
|
+
},
|
|
749
|
+
{
|
|
750
|
+
"type": "object",
|
|
751
|
+
"additionalProperties": false,
|
|
752
|
+
"required": [
|
|
753
|
+
"claim",
|
|
754
|
+
"startsWith"
|
|
755
|
+
],
|
|
756
|
+
"properties": {
|
|
757
|
+
"claim": {
|
|
758
|
+
"type": "string",
|
|
759
|
+
"minLength": 1,
|
|
760
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
761
|
+
},
|
|
762
|
+
"startsWith": {
|
|
763
|
+
"type": "string",
|
|
764
|
+
"minLength": 1,
|
|
765
|
+
"description": "The prefix the claim's string value must start with. Non-string claim values never match. Must not be empty — an empty prefix would match every value. When the claim value is an array, the check passes if any string element starts with this prefix."
|
|
766
|
+
}
|
|
767
|
+
}
|
|
768
|
+
}
|
|
769
|
+
]
|
|
770
|
+
},
|
|
771
|
+
"description": "Claim checks of which at least one must pass. The maximum combinator nesting depth is reached, so entries must be single claim checks."
|
|
772
|
+
}
|
|
773
|
+
}
|
|
774
|
+
},
|
|
775
|
+
{
|
|
776
|
+
"type": "object",
|
|
777
|
+
"additionalProperties": false,
|
|
778
|
+
"required": ["claim", "eq"],
|
|
779
|
+
"properties": {
|
|
780
|
+
"claim": {
|
|
781
|
+
"type": "string",
|
|
782
|
+
"minLength": 1,
|
|
783
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
784
|
+
},
|
|
785
|
+
"eq": {
|
|
786
|
+
"type": [
|
|
787
|
+
"string",
|
|
788
|
+
"number",
|
|
789
|
+
"boolean"
|
|
790
|
+
],
|
|
791
|
+
"description": "The exact value the claim must equal. Comparison is strict and type-sensitive: the string '42' does not equal the number 42. When the claim value is an array, the check passes if any element equals this value."
|
|
792
|
+
}
|
|
793
|
+
}
|
|
794
|
+
},
|
|
795
|
+
{
|
|
796
|
+
"type": "object",
|
|
797
|
+
"additionalProperties": false,
|
|
798
|
+
"required": ["claim", "in"],
|
|
799
|
+
"properties": {
|
|
800
|
+
"claim": {
|
|
801
|
+
"type": "string",
|
|
802
|
+
"minLength": 1,
|
|
803
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
804
|
+
},
|
|
805
|
+
"in": {
|
|
806
|
+
"type": "array",
|
|
807
|
+
"minItems": 1,
|
|
808
|
+
"items": {
|
|
809
|
+
"type": [
|
|
810
|
+
"string",
|
|
811
|
+
"number",
|
|
812
|
+
"boolean"
|
|
813
|
+
]
|
|
814
|
+
},
|
|
815
|
+
"description": "Allowed values for the claim. The check passes when the claim value equals any listed value (strict, type-sensitive comparison). When the claim value is an array, the check passes if any element equals any listed value."
|
|
816
|
+
}
|
|
817
|
+
}
|
|
818
|
+
},
|
|
819
|
+
{
|
|
820
|
+
"type": "object",
|
|
821
|
+
"additionalProperties": false,
|
|
822
|
+
"required": ["claim", "startsWith"],
|
|
823
|
+
"properties": {
|
|
824
|
+
"claim": {
|
|
825
|
+
"type": "string",
|
|
826
|
+
"minLength": 1,
|
|
827
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
828
|
+
},
|
|
829
|
+
"startsWith": {
|
|
830
|
+
"type": "string",
|
|
831
|
+
"minLength": 1,
|
|
832
|
+
"description": "The prefix the claim's string value must start with. Non-string claim values never match. Must not be empty — an empty prefix would match every value. When the claim value is an array, the check passes if any string element starts with this prefix."
|
|
833
|
+
}
|
|
834
|
+
}
|
|
835
|
+
}
|
|
836
|
+
]
|
|
837
|
+
},
|
|
838
|
+
"description": "Nested rules that must all pass."
|
|
839
|
+
}
|
|
840
|
+
}
|
|
841
|
+
},
|
|
842
|
+
{
|
|
843
|
+
"type": "object",
|
|
844
|
+
"additionalProperties": false,
|
|
845
|
+
"required": ["or"],
|
|
846
|
+
"properties": {
|
|
847
|
+
"or": {
|
|
848
|
+
"type": "array",
|
|
849
|
+
"minItems": 1,
|
|
850
|
+
"items": {
|
|
851
|
+
"description": "A third-level rule: a single claim check or an and/or combination of claim checks. Combinators cannot nest any deeper.",
|
|
852
|
+
"oneOf": [
|
|
853
|
+
{
|
|
854
|
+
"type": "object",
|
|
855
|
+
"additionalProperties": false,
|
|
856
|
+
"required": ["and"],
|
|
857
|
+
"properties": {
|
|
858
|
+
"and": {
|
|
859
|
+
"type": "array",
|
|
860
|
+
"minItems": 1,
|
|
861
|
+
"items": {
|
|
862
|
+
"description": "A single claim check using exactly one operator: eq, in, or startsWith.",
|
|
863
|
+
"oneOf": [
|
|
864
|
+
{
|
|
865
|
+
"type": "object",
|
|
866
|
+
"additionalProperties": false,
|
|
867
|
+
"required": ["claim", "eq"],
|
|
868
|
+
"properties": {
|
|
869
|
+
"claim": {
|
|
870
|
+
"type": "string",
|
|
871
|
+
"minLength": 1,
|
|
872
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
873
|
+
},
|
|
874
|
+
"eq": {
|
|
875
|
+
"type": [
|
|
876
|
+
"string",
|
|
877
|
+
"number",
|
|
878
|
+
"boolean"
|
|
879
|
+
],
|
|
880
|
+
"description": "The exact value the claim must equal. Comparison is strict and type-sensitive: the string '42' does not equal the number 42. When the claim value is an array, the check passes if any element equals this value."
|
|
881
|
+
}
|
|
882
|
+
}
|
|
883
|
+
},
|
|
884
|
+
{
|
|
885
|
+
"type": "object",
|
|
886
|
+
"additionalProperties": false,
|
|
887
|
+
"required": ["claim", "in"],
|
|
888
|
+
"properties": {
|
|
889
|
+
"claim": {
|
|
890
|
+
"type": "string",
|
|
891
|
+
"minLength": 1,
|
|
892
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
893
|
+
},
|
|
894
|
+
"in": {
|
|
895
|
+
"type": "array",
|
|
896
|
+
"minItems": 1,
|
|
897
|
+
"items": {
|
|
898
|
+
"type": [
|
|
899
|
+
"string",
|
|
900
|
+
"number",
|
|
901
|
+
"boolean"
|
|
902
|
+
]
|
|
903
|
+
},
|
|
904
|
+
"description": "Allowed values for the claim. The check passes when the claim value equals any listed value (strict, type-sensitive comparison). When the claim value is an array, the check passes if any element equals any listed value."
|
|
905
|
+
}
|
|
906
|
+
}
|
|
907
|
+
},
|
|
908
|
+
{
|
|
909
|
+
"type": "object",
|
|
910
|
+
"additionalProperties": false,
|
|
911
|
+
"required": [
|
|
912
|
+
"claim",
|
|
913
|
+
"startsWith"
|
|
914
|
+
],
|
|
915
|
+
"properties": {
|
|
916
|
+
"claim": {
|
|
917
|
+
"type": "string",
|
|
918
|
+
"minLength": 1,
|
|
919
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
920
|
+
},
|
|
921
|
+
"startsWith": {
|
|
922
|
+
"type": "string",
|
|
923
|
+
"minLength": 1,
|
|
924
|
+
"description": "The prefix the claim's string value must start with. Non-string claim values never match. Must not be empty — an empty prefix would match every value. When the claim value is an array, the check passes if any string element starts with this prefix."
|
|
925
|
+
}
|
|
926
|
+
}
|
|
927
|
+
}
|
|
928
|
+
]
|
|
929
|
+
},
|
|
930
|
+
"description": "Claim checks that must all pass. The maximum combinator nesting depth is reached, so entries must be single claim checks."
|
|
931
|
+
}
|
|
932
|
+
}
|
|
933
|
+
},
|
|
934
|
+
{
|
|
935
|
+
"type": "object",
|
|
936
|
+
"additionalProperties": false,
|
|
937
|
+
"required": ["or"],
|
|
938
|
+
"properties": {
|
|
939
|
+
"or": {
|
|
940
|
+
"type": "array",
|
|
941
|
+
"minItems": 1,
|
|
942
|
+
"items": {
|
|
943
|
+
"description": "A single claim check using exactly one operator: eq, in, or startsWith.",
|
|
944
|
+
"oneOf": [
|
|
945
|
+
{
|
|
946
|
+
"type": "object",
|
|
947
|
+
"additionalProperties": false,
|
|
948
|
+
"required": ["claim", "eq"],
|
|
949
|
+
"properties": {
|
|
950
|
+
"claim": {
|
|
951
|
+
"type": "string",
|
|
952
|
+
"minLength": 1,
|
|
953
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
954
|
+
},
|
|
955
|
+
"eq": {
|
|
956
|
+
"type": [
|
|
957
|
+
"string",
|
|
958
|
+
"number",
|
|
959
|
+
"boolean"
|
|
960
|
+
],
|
|
961
|
+
"description": "The exact value the claim must equal. Comparison is strict and type-sensitive: the string '42' does not equal the number 42. When the claim value is an array, the check passes if any element equals this value."
|
|
962
|
+
}
|
|
963
|
+
}
|
|
964
|
+
},
|
|
965
|
+
{
|
|
966
|
+
"type": "object",
|
|
967
|
+
"additionalProperties": false,
|
|
968
|
+
"required": ["claim", "in"],
|
|
969
|
+
"properties": {
|
|
970
|
+
"claim": {
|
|
971
|
+
"type": "string",
|
|
972
|
+
"minLength": 1,
|
|
973
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
974
|
+
},
|
|
975
|
+
"in": {
|
|
976
|
+
"type": "array",
|
|
977
|
+
"minItems": 1,
|
|
978
|
+
"items": {
|
|
979
|
+
"type": [
|
|
980
|
+
"string",
|
|
981
|
+
"number",
|
|
982
|
+
"boolean"
|
|
983
|
+
]
|
|
984
|
+
},
|
|
985
|
+
"description": "Allowed values for the claim. The check passes when the claim value equals any listed value (strict, type-sensitive comparison). When the claim value is an array, the check passes if any element equals any listed value."
|
|
986
|
+
}
|
|
987
|
+
}
|
|
988
|
+
},
|
|
989
|
+
{
|
|
990
|
+
"type": "object",
|
|
991
|
+
"additionalProperties": false,
|
|
992
|
+
"required": [
|
|
993
|
+
"claim",
|
|
994
|
+
"startsWith"
|
|
995
|
+
],
|
|
996
|
+
"properties": {
|
|
997
|
+
"claim": {
|
|
998
|
+
"type": "string",
|
|
999
|
+
"minLength": 1,
|
|
1000
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
1001
|
+
},
|
|
1002
|
+
"startsWith": {
|
|
1003
|
+
"type": "string",
|
|
1004
|
+
"minLength": 1,
|
|
1005
|
+
"description": "The prefix the claim's string value must start with. Non-string claim values never match. Must not be empty — an empty prefix would match every value. When the claim value is an array, the check passes if any string element starts with this prefix."
|
|
1006
|
+
}
|
|
1007
|
+
}
|
|
1008
|
+
}
|
|
1009
|
+
]
|
|
1010
|
+
},
|
|
1011
|
+
"description": "Claim checks of which at least one must pass. The maximum combinator nesting depth is reached, so entries must be single claim checks."
|
|
1012
|
+
}
|
|
1013
|
+
}
|
|
1014
|
+
},
|
|
1015
|
+
{
|
|
1016
|
+
"type": "object",
|
|
1017
|
+
"additionalProperties": false,
|
|
1018
|
+
"required": ["claim", "eq"],
|
|
1019
|
+
"properties": {
|
|
1020
|
+
"claim": {
|
|
1021
|
+
"type": "string",
|
|
1022
|
+
"minLength": 1,
|
|
1023
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
1024
|
+
},
|
|
1025
|
+
"eq": {
|
|
1026
|
+
"type": [
|
|
1027
|
+
"string",
|
|
1028
|
+
"number",
|
|
1029
|
+
"boolean"
|
|
1030
|
+
],
|
|
1031
|
+
"description": "The exact value the claim must equal. Comparison is strict and type-sensitive: the string '42' does not equal the number 42. When the claim value is an array, the check passes if any element equals this value."
|
|
1032
|
+
}
|
|
1033
|
+
}
|
|
1034
|
+
},
|
|
1035
|
+
{
|
|
1036
|
+
"type": "object",
|
|
1037
|
+
"additionalProperties": false,
|
|
1038
|
+
"required": ["claim", "in"],
|
|
1039
|
+
"properties": {
|
|
1040
|
+
"claim": {
|
|
1041
|
+
"type": "string",
|
|
1042
|
+
"minLength": 1,
|
|
1043
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
1044
|
+
},
|
|
1045
|
+
"in": {
|
|
1046
|
+
"type": "array",
|
|
1047
|
+
"minItems": 1,
|
|
1048
|
+
"items": {
|
|
1049
|
+
"type": [
|
|
1050
|
+
"string",
|
|
1051
|
+
"number",
|
|
1052
|
+
"boolean"
|
|
1053
|
+
]
|
|
1054
|
+
},
|
|
1055
|
+
"description": "Allowed values for the claim. The check passes when the claim value equals any listed value (strict, type-sensitive comparison). When the claim value is an array, the check passes if any element equals any listed value."
|
|
1056
|
+
}
|
|
1057
|
+
}
|
|
1058
|
+
},
|
|
1059
|
+
{
|
|
1060
|
+
"type": "object",
|
|
1061
|
+
"additionalProperties": false,
|
|
1062
|
+
"required": ["claim", "startsWith"],
|
|
1063
|
+
"properties": {
|
|
1064
|
+
"claim": {
|
|
1065
|
+
"type": "string",
|
|
1066
|
+
"minLength": 1,
|
|
1067
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
1068
|
+
},
|
|
1069
|
+
"startsWith": {
|
|
1070
|
+
"type": "string",
|
|
1071
|
+
"minLength": 1,
|
|
1072
|
+
"description": "The prefix the claim's string value must start with. Non-string claim values never match. Must not be empty — an empty prefix would match every value. When the claim value is an array, the check passes if any string element starts with this prefix."
|
|
1073
|
+
}
|
|
1074
|
+
}
|
|
1075
|
+
}
|
|
1076
|
+
]
|
|
1077
|
+
},
|
|
1078
|
+
"description": "Nested rules of which at least one must pass."
|
|
1079
|
+
}
|
|
1080
|
+
}
|
|
1081
|
+
},
|
|
1082
|
+
{
|
|
1083
|
+
"type": "object",
|
|
1084
|
+
"additionalProperties": false,
|
|
1085
|
+
"required": ["claim", "eq"],
|
|
1086
|
+
"properties": {
|
|
1087
|
+
"claim": {
|
|
1088
|
+
"type": "string",
|
|
1089
|
+
"minLength": 1,
|
|
1090
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
1091
|
+
},
|
|
1092
|
+
"eq": {
|
|
1093
|
+
"type": ["string", "number", "boolean"],
|
|
1094
|
+
"description": "The exact value the claim must equal. Comparison is strict and type-sensitive: the string '42' does not equal the number 42. When the claim value is an array, the check passes if any element equals this value."
|
|
1095
|
+
}
|
|
1096
|
+
}
|
|
1097
|
+
},
|
|
1098
|
+
{
|
|
1099
|
+
"type": "object",
|
|
1100
|
+
"additionalProperties": false,
|
|
1101
|
+
"required": ["claim", "in"],
|
|
1102
|
+
"properties": {
|
|
1103
|
+
"claim": {
|
|
1104
|
+
"type": "string",
|
|
1105
|
+
"minLength": 1,
|
|
1106
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
1107
|
+
},
|
|
1108
|
+
"in": {
|
|
1109
|
+
"type": "array",
|
|
1110
|
+
"minItems": 1,
|
|
1111
|
+
"items": {
|
|
1112
|
+
"type": ["string", "number", "boolean"]
|
|
1113
|
+
},
|
|
1114
|
+
"description": "Allowed values for the claim. The check passes when the claim value equals any listed value (strict, type-sensitive comparison). When the claim value is an array, the check passes if any element equals any listed value."
|
|
1115
|
+
}
|
|
1116
|
+
}
|
|
1117
|
+
},
|
|
1118
|
+
{
|
|
1119
|
+
"type": "object",
|
|
1120
|
+
"additionalProperties": false,
|
|
1121
|
+
"required": ["claim", "startsWith"],
|
|
1122
|
+
"properties": {
|
|
1123
|
+
"claim": {
|
|
1124
|
+
"type": "string",
|
|
1125
|
+
"minLength": 1,
|
|
1126
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
1127
|
+
},
|
|
1128
|
+
"startsWith": {
|
|
1129
|
+
"type": "string",
|
|
1130
|
+
"minLength": 1,
|
|
1131
|
+
"description": "The prefix the claim's string value must start with. Non-string claim values never match. Must not be empty — an empty prefix would match every value. When the claim value is an array, the check passes if any string element starts with this prefix."
|
|
1132
|
+
}
|
|
1133
|
+
}
|
|
1134
|
+
}
|
|
1135
|
+
]
|
|
1136
|
+
},
|
|
1137
|
+
"description": "Nested rules of which at least one must pass."
|
|
1138
|
+
}
|
|
1139
|
+
}
|
|
1140
|
+
},
|
|
1141
|
+
{
|
|
1142
|
+
"type": "object",
|
|
1143
|
+
"additionalProperties": false,
|
|
1144
|
+
"required": ["claim", "eq"],
|
|
1145
|
+
"properties": {
|
|
1146
|
+
"claim": {
|
|
1147
|
+
"type": "string",
|
|
1148
|
+
"minLength": 1,
|
|
1149
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
1150
|
+
},
|
|
1151
|
+
"eq": {
|
|
1152
|
+
"type": ["string", "number", "boolean"],
|
|
1153
|
+
"description": "The exact value the claim must equal. Comparison is strict and type-sensitive: the string '42' does not equal the number 42. When the claim value is an array, the check passes if any element equals this value."
|
|
1154
|
+
}
|
|
1155
|
+
}
|
|
1156
|
+
},
|
|
1157
|
+
{
|
|
1158
|
+
"type": "object",
|
|
1159
|
+
"additionalProperties": false,
|
|
1160
|
+
"required": ["claim", "in"],
|
|
1161
|
+
"properties": {
|
|
1162
|
+
"claim": {
|
|
1163
|
+
"type": "string",
|
|
1164
|
+
"minLength": 1,
|
|
1165
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
1166
|
+
},
|
|
1167
|
+
"in": {
|
|
1168
|
+
"type": "array",
|
|
1169
|
+
"minItems": 1,
|
|
1170
|
+
"items": {
|
|
1171
|
+
"type": ["string", "number", "boolean"]
|
|
1172
|
+
},
|
|
1173
|
+
"description": "Allowed values for the claim. The check passes when the claim value equals any listed value (strict, type-sensitive comparison). When the claim value is an array, the check passes if any element equals any listed value."
|
|
1174
|
+
}
|
|
1175
|
+
}
|
|
1176
|
+
},
|
|
1177
|
+
{
|
|
1178
|
+
"type": "object",
|
|
1179
|
+
"additionalProperties": false,
|
|
1180
|
+
"required": ["claim", "startsWith"],
|
|
1181
|
+
"properties": {
|
|
1182
|
+
"claim": {
|
|
1183
|
+
"type": "string",
|
|
1184
|
+
"minLength": 1,
|
|
1185
|
+
"description": "A light JSON-path selector into the authenticated user's claims (request.user.data). Use dot notation for nested claims, e.g. 'address.country'. Use bracket notation with quotes for claim names that contain dots or slashes — namespaced claims — e.g. \\[\"https://sts.amazonaws.com/\"\\]\\[\"lambda\\_source\\_function\\_arn\"\\]; the two notations may be mixed. A missing claim always fails the check."
|
|
1186
|
+
},
|
|
1187
|
+
"startsWith": {
|
|
1188
|
+
"type": "string",
|
|
1189
|
+
"minLength": 1,
|
|
1190
|
+
"description": "The prefix the claim's string value must start with. Non-string claim values never match. Must not be empty — an empty prefix would match every value. When the claim value is an array, the check passes if any string element starts with this prefix."
|
|
1191
|
+
}
|
|
1192
|
+
}
|
|
1193
|
+
}
|
|
1194
|
+
]
|
|
1195
|
+
}
|
|
1196
|
+
},
|
|
1197
|
+
"examples": [
|
|
1198
|
+
{
|
|
1199
|
+
"rule": {
|
|
1200
|
+
"or": [
|
|
1201
|
+
{
|
|
1202
|
+
"claim": "sub",
|
|
1203
|
+
"in": [
|
|
1204
|
+
"ci-deployer@my-project.iam.gserviceaccount.com",
|
|
1205
|
+
"112233445566778899000"
|
|
1206
|
+
]
|
|
1207
|
+
},
|
|
1208
|
+
{
|
|
1209
|
+
"claim": "email",
|
|
1210
|
+
"eq": "ci-deployer@my-project.iam.gserviceaccount.com"
|
|
1211
|
+
}
|
|
1212
|
+
]
|
|
1213
|
+
}
|
|
1214
|
+
},
|
|
1215
|
+
{
|
|
1216
|
+
"rule": {
|
|
1217
|
+
"and": [
|
|
1218
|
+
{
|
|
1219
|
+
"claim": "sub",
|
|
1220
|
+
"eq": "$env(ALLOWED_ROLE_ARN)"
|
|
1221
|
+
},
|
|
1222
|
+
{
|
|
1223
|
+
"claim": "['https://sts.amazonaws.com/']['lambda_source_function_arn']",
|
|
1224
|
+
"eq": "arn:aws:lambda:us-east-1:123456789012:function:my-caller"
|
|
1225
|
+
}
|
|
1226
|
+
]
|
|
1227
|
+
}
|
|
1228
|
+
},
|
|
1229
|
+
{
|
|
1230
|
+
"rule": {
|
|
1231
|
+
"and": [
|
|
1232
|
+
{
|
|
1233
|
+
"claim": "email_verified",
|
|
1234
|
+
"eq": true
|
|
1235
|
+
},
|
|
1236
|
+
{
|
|
1237
|
+
"or": [
|
|
1238
|
+
{
|
|
1239
|
+
"claim": "sub",
|
|
1240
|
+
"startsWith": "arn:aws:sts::123456789012:assumed-role/my-role/"
|
|
1241
|
+
},
|
|
1242
|
+
{
|
|
1243
|
+
"claim": "groups",
|
|
1244
|
+
"eq": "gateway-admins"
|
|
1245
|
+
}
|
|
1246
|
+
]
|
|
1247
|
+
}
|
|
1248
|
+
]
|
|
1249
|
+
}
|
|
1250
|
+
}
|
|
1251
|
+
]
|
|
1252
|
+
}
|
|
1253
|
+
},
|
|
1254
|
+
"examples": [
|
|
1255
|
+
{
|
|
1256
|
+
"export": "RequireUserClaimsInboundPolicy",
|
|
1257
|
+
"module": "$import(@zuplo/runtime)",
|
|
1258
|
+
"options": {
|
|
1259
|
+
"rule": {
|
|
1260
|
+
"or": [
|
|
1261
|
+
{
|
|
1262
|
+
"claim": "sub",
|
|
1263
|
+
"in": [
|
|
1264
|
+
"ci-deployer@my-project.iam.gserviceaccount.com",
|
|
1265
|
+
"112233445566778899000"
|
|
1266
|
+
]
|
|
1267
|
+
},
|
|
1268
|
+
{
|
|
1269
|
+
"claim": "email",
|
|
1270
|
+
"eq": "ci-deployer@my-project.iam.gserviceaccount.com"
|
|
1271
|
+
}
|
|
1272
|
+
]
|
|
1273
|
+
}
|
|
1274
|
+
}
|
|
1275
|
+
},
|
|
1276
|
+
{
|
|
1277
|
+
"export": "RequireUserClaimsInboundPolicy",
|
|
1278
|
+
"module": "$import(@zuplo/runtime)",
|
|
1279
|
+
"options": {
|
|
1280
|
+
"rule": {
|
|
1281
|
+
"and": [
|
|
1282
|
+
{
|
|
1283
|
+
"claim": "sub",
|
|
1284
|
+
"eq": "$env(ALLOWED_ROLE_ARN)"
|
|
1285
|
+
},
|
|
1286
|
+
{
|
|
1287
|
+
"claim": "['https://sts.amazonaws.com/']['lambda_source_function_arn']",
|
|
1288
|
+
"eq": "arn:aws:lambda:us-east-1:123456789012:function:my-caller"
|
|
1289
|
+
}
|
|
1290
|
+
]
|
|
1291
|
+
}
|
|
1292
|
+
}
|
|
1293
|
+
},
|
|
1294
|
+
{
|
|
1295
|
+
"export": "RequireUserClaimsInboundPolicy",
|
|
1296
|
+
"module": "$import(@zuplo/runtime)",
|
|
1297
|
+
"options": {
|
|
1298
|
+
"rule": {
|
|
1299
|
+
"and": [
|
|
1300
|
+
{
|
|
1301
|
+
"claim": "email_verified",
|
|
1302
|
+
"eq": true
|
|
1303
|
+
},
|
|
1304
|
+
{
|
|
1305
|
+
"or": [
|
|
1306
|
+
{
|
|
1307
|
+
"claim": "sub",
|
|
1308
|
+
"startsWith": "arn:aws:sts::123456789012:assumed-role/my-role/"
|
|
1309
|
+
},
|
|
1310
|
+
{
|
|
1311
|
+
"claim": "groups",
|
|
1312
|
+
"eq": "gateway-admins"
|
|
1313
|
+
}
|
|
1314
|
+
]
|
|
1315
|
+
}
|
|
1316
|
+
]
|
|
1317
|
+
}
|
|
1318
|
+
}
|
|
1319
|
+
}
|
|
1320
|
+
]
|
|
1321
|
+
}
|
|
1322
|
+
}
|
|
1323
|
+
}
|