Class QCredentialScope

java.lang.Object
com.kingsrook.qqq.backend.core.model.session.QCredentialScope
All Implemented Interfaces:
Serializable, Cloneable
public class QCredentialScope extends Object implements Serializable, Cloneable
The scope of the credential a session was created from - e.g. an access token (Authentik app-password / OAuth client) limited to some tables, or to reading. Set on the QSession by the authentication module's customizer (e.g. qbit-authentik from its token mapping); enforced by core: - PermissionsHelper intersects it with the user's live permissions: an object outside a non-null set is denied (hidden from metadata, refused); readOnly denies table writes and every process not explicitly listed. A scope only narrows - revoking the user's permission narrows the token. - The UI API refuses operations outside operationIds (`METHOD /template`, e.g. `POST /table/{tableName}/query`). - The session's client channel is `token:` (audited); the request cannot relabel it. Every set is null for "unrestricted". See docs/UI-API-CLIENT-CHANNELS.md.
See Also:

  • Constructor Details

    • QCredentialScope

      public QCredentialScope()

  • Method Details

    • allows

      public static boolean allows(Set<String> set, String name)
      Whether a set allows a name (null set: unrestricted).

    • getClientChannel

      public String getClientChannel()
      The client channel of sessions under this scope: token:.

    • clone

      public QCredentialScope clone()
      A deep copy.
      Overrides:
      clone in class Object

    • getCredentialId

      public String getCredentialId()
      Getter for credentialId

    • withCredentialId

      public QCredentialScope withCredentialId(String credentialId)
      Fluent setter for credentialId - the token identifier (for audit).

    • getReadOnly

      public boolean getReadOnly()
      Getter for readOnly

    • withReadOnly

      public QCredentialScope withReadOnly(boolean readOnly)
      Fluent setter for readOnly - no table writes, no unlisted processes.

    • getApps

      public Set<String> getApps()
      Getter for apps

    • withApps

      public QCredentialScope withApps(Set<String> apps)
      Fluent setter for apps (null: unrestricted)

    • getTables

      public Set<String> getTables()
      Getter for tables

    • withTables

      public QCredentialScope withTables(Set<String> tables)
      Fluent setter for tables (null: unrestricted)

    • getProcesses

      public Set<String> getProcesses()
      Getter for processes

    • withProcesses

      public QCredentialScope withProcesses(Set<String> processes)
      Fluent setter for processes (null: unrestricted, unless readOnly)

    • getReports

      public Set<String> getReports()
      Getter for reports

    • withReports

      public QCredentialScope withReports(Set<String> reports)
      Fluent setter for reports (null: unrestricted)

    • getWidgets

      public Set<String> getWidgets()
      Getter for widgets

    • withWidgets

      public QCredentialScope withWidgets(Set<String> widgets)
      Fluent setter for widgets (null: unrestricted)

    • getOperationIds

      public Set<String> getOperationIds()
      Getter for operationIds

    • withOperationIds

      public QCredentialScope withOperationIds(Set<String> operationIds)
      Fluent setter for operationIds - UI API operations as `METHOD /template` (null: unrestricted).