cmind/authz/authz.proto
Package: cmind.authz
Enums
Scope
Scope is the level a request acts in. A request acts in exactly one, so a requirement is an exact match and not a minimum: acting inside a tenant is not also acting in whatever contains that tenant.
| Value | Number | Description |
|---|---|---|
SCOPE_UNSPECIFIED | 0 | |
SCOPE_PLATFORM | 1 | |
SCOPE_TENANT | 2 |
Messages
FgaAuthz
FgaAuthz defines an OpenFGA authorization check for a method. The relation is a fixed string (e.g. "can_view"), and the object follows OpenFGA's type:id format with template variables pulled from the request (e.g. "document:{id}"). The one variable that does not come from the request is {@tenant_id}, the tenant off the passport. Using it requires SCOPE_TENANT.
| Field | Type | Number | Description |
|---|---|---|---|
object | string | 1 | |
relation | string | 2 | |
scope | Scope | 3 | Reject the request unless it acts in this scope, before any FGA check runs. Leave unset when the service declares one; declaring both is an error. |