Skip to content

Commit b757e38

Browse files
elf-pavlikelf-pavlik
committed
add Grant Registry and Delegation Issuance
1 parent df5b921 commit b757e38

8 files changed

Lines changed: 144 additions & 7 deletions

File tree

‎proposals/specification/access-authorizations.bs‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1354,3 +1354,33 @@ The [=Authorization Registry=] resources MAY use any resource or subject name.
13541354

13551355
The resource names for [=Access Grants=] <em class="rfc2119">SHOULD</em>
13561356
be unpredictable.
1357+
1358+
## Grant Registry ## {#grant-registry}
1359+
1360+
Issue(334):
1361+
1362+
A <dfn>Grant Registry</dfn> is a collection of [=Data Grants=].
1363+
1364+
The [=Grant Registry=] is linked to a [=Social Agent=] via their [=Registry Set=].
1365+
1366+
A [=Grant Registry=] links to any number of registered [=Data Grants=].
1367+
1368+
<table class="classinfo data" align="left" id="classGrantRegistry">
1369+
<colgroup></colgroup>
1370+
<colgroup></colgroup>
1371+
<colgroup></colgroup>
1372+
<thead>
1373+
<tr>
1374+
<th>Property</th>
1375+
<th>Range</th>
1376+
<th>Description</th>
1377+
</tr>
1378+
</thead>
1379+
<tbody>
1380+
<tr>
1381+
<td>ldp:contains</td>
1382+
<td>[DataGrant](interop.ttl#DataGrant)</td>
1383+
<td>Link to associated [=Data Grants=]</td>
1384+
</tr>
1385+
</tbody>
1386+
</table>

‎proposals/specification/data-authorization.bs‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -151,10 +151,24 @@ The following query parameters are defined:
151151
</figure>
152152

153153

154-
### Resource Indication ### {#resource-indication}
154+
#### Resource Indication #### {#resource-indication}
155155

156156
When the <code>resource</code> query parameter is used, the Authorization Agent will use it
157-
as an indication that access to a specific data instance is intended to be shared.
157+
as an indication that access to a specific data instance is intended to be shared.
158+
159+
### Delegation Issuance Endpoint ### {#delegation-issuance-endpoint}
160+
161+
[=Authorization Agent=] of a grantee, can request delegation of [=Data Grants=] using this endpoint.
162+
This endpoint expects HTTP `POST` with content type `application/json` including top level JSON object
163+
representing a [=Data Grant=] without an `id` and all inheriting data grants nested in `hasInheritingGrant`.
164+
165+
[JSON Schema](schema.json#GrantData)
166+
167+
[=Authorization Agent=] of a data owner
168+
169+
* MUST either create all requested grants or return error.
170+
* MUST return `application/json` with an array including `id` for every created grant when responding with success.
171+
158172

159173
### Authorization Agent Discovery ### {#authorization-agent-discovery}
160174

‎proposals/specification/interop.ttl‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,13 @@ rdfs:label "Terms for application interoperability in Solid"@en .
6060
rdfs:domain :AuthorizationAgent ;
6161
rdfs:label "Has Authorization Redirect Endpoint"@en .
6262

63+
:hasDelegationIssuanceEndpoint
64+
a rdf:Property ;
65+
rdfs:comment "URI expected to be used to request delegated grants"@ en ;
66+
rdfs:isDefinedBy <> ;
67+
rdfs:domain :AuthorizationAgent ;
68+
rdfs:label "Has Delegation Issuance Endpoint"@en .
69+
6370

6471
# RegistrySet Class
6572
#############################################################################

‎proposals/specification/role.bs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,9 @@ internal to the context of the [=Social Agent=] defining the Role.
3535
</figure>
3636

3737
When [=Authorization Agent=] generates [=Data Grants=] from a [=Data Authorization=]
38-
* if a [=Role=] is used as `dataOwner` it MUST generate a [=Data Grant=] for each member of that [=Role=] as `dataOwner`.
39-
* if a [=Role=] is used as `grantee` it MUST generate a [=Data Grant=] for each member of that [=Role=] as `grantee`.
40-
* if a [=Role=] is used as both `dataOwner` and `grantee` it MUST generate a [=Data Grant=] for the cartesian product of the two [=Roles=], with each member as corresponding `dataOwner` or `grantee`.
38+
* MUST generate a [=Data Grant=] for each member of that [=Role=] as `dataOwner` if a [=Role=] is used as `dataOwner`.
39+
* MUST generate a [=Data Grant=] for each member of that [=Role=] as `grantee` if a [=Role=] is used as `grantee`.
40+
* MUST generate a [=Data Grant=] for the cartesian product of the two [=Roles=], with each member as corresponding `dataOwner` or `grantee` if a [=Role=] is used as both `dataOwner` and `grantee`.
4141

4242
## Role Registry ## {#datamodel-role-registry}
4343

‎proposals/specification/schema.json‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"$schema": "http://json-schema.org/draft-06/schema#",
3+
"definitions": {
4+
"GrantData": {
5+
"title": "GrantData",
6+
"type": "object",
7+
"additionalProperties": false,
8+
"properties": {
9+
"grantee": {
10+
"type": "string",
11+
"format": "uri",
12+
"qt-uri-protocols": ["https"]
13+
},
14+
"grantedBy": {
15+
"type": "string",
16+
"format": "uri",
17+
"qt-uri-protocols": ["https"]
18+
},
19+
"dataOwner": {
20+
"type": "string",
21+
"format": "uri",
22+
"qt-uri-protocols": ["https"]
23+
},
24+
"registeredShapeTree": {
25+
"type": "string",
26+
"format": "uri",
27+
"qt-uri-protocols": ["https"]
28+
},
29+
"hasDataRegistration": {
30+
"type": "string",
31+
"format": "uri",
32+
"qt-uri-protocols": ["https"]
33+
},
34+
"hasStorage": {
35+
"type": "string",
36+
"format": "uri",
37+
"qt-uri-protocols": ["https"]
38+
},
39+
"scopeOfGrant": {
40+
"type": "string",
41+
"format": "uri",
42+
"qt-uri-protocols": ["http"]
43+
},
44+
"accessMode": {
45+
"type": "array",
46+
"items": {
47+
"type": "string",
48+
"format": "uri",
49+
"qt-uri-protocols": ["http"]
50+
}
51+
},
52+
"hasDataInstance": {
53+
"type": "array",
54+
"items": {
55+
"type": "string",
56+
"format": "uri",
57+
"qt-uri-protocols": ["https"]
58+
}
59+
},
60+
"hasInheritingGrant": {
61+
"type": "array",
62+
"items": {
63+
"$ref": "#/definitions/GrantData"
64+
}
65+
}
66+
},
67+
"required": [
68+
"accessMode",
69+
"dataOwner",
70+
"delegationOfGrant",
71+
"grantedBy",
72+
"grantee",
73+
"hasDataRegistration",
74+
"hasStorage",
75+
"registeredShapeTree",
76+
"scopeOfGrant"
77+
]
78+
}
79+
}
80+
}

‎proposals/specification/snippets/alice.example/registries.ttl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ alice:registries
88
interop:hasAgentRegistry alice:agents\/ ;
99
interop:hasRoleRegistry alice:roles\/ ;
1010
interop:hasAuthorizationRegistry alice:authorization\/ ;
11+
interop:hasGrantRegistry alice:grants\/ ;
1112
interop:hasDataRegistry
1213
alice-work:data\/ ,
1314
alice-personal:data\/ .

‎proposals/specification/snippets/alice.jarvis.example/alice.jarvis.example.ttl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,5 @@ PREFIX alice-jarvis: <https://alice.jarvis.example/>
55

66
alice-jarvis:
77
a interop:AuthorizationAgent ;
8-
######## Authorization Redirect Endpoint ########
9-
interop:hasAuthorizationRedirectEndpoint alice-jarvis:redirect .
8+
interop:hasAuthorizationRedirectEndpoint alice-jarvis:redirect ;
9+
interop:hasDelegationIssuanceEndpoint alice-jarvis:delegate .

‎proposals/specification/social-agent.bs‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,11 @@ authorized [=Applications=].
104104
<td>[AuthorizationRegistry](#classAuthorizationRegistry)</td>
105105
<td>[=Authorization Registry=] for the [=Social Agent=]</td>
106106
</tr>
107+
<tr>
108+
<td>hasGrantRegistry</td>
109+
<td>[GrantRegistry](#classGrantRegistry)</td>
110+
<td>[=Grant Registry=] for the [=Social Agent=]</td>
111+
</tr>
107112
<tr>
108113
<td>hasDataRegistry</td>
109114
<td>[DataRegistry](#classDataRegistry)</td>

0 commit comments

Comments
 (0)