ores.iam.run_grant

Table of Contents

A run grant records that a person allows the runs of one resource, such as a scheduled report definition, to act in one tenant and one party with one role. It holds no secret: using it needs a step service's own token and the token exchange, and IAM re-checks the grant and its grantor at every use. It is IAM's form of the Grant Management pattern, and Run grants and run tokens states its checks and its lifecycle.

The table is readable over the wire and written only by IAM's own create and revoke operations, which check that the grantor holds the role in the party: :client_read_only: removes the generic write verbs from the wire and keeps the repository writable for those operations.

1. Flags

2. Columns

2.1. id

UUID uniquely identifying this run grant.

The grant id. It is random, and it is not a credential.

2.2. party_id

The party the runs act in. Enforced by row level security, so a party sees only its own grants. 

ctx.generate_uuid()

2.3. resource

What the grant serves, as <component>.<entity>/<id>, for example reporting.report_definition/2d6fee63-.... 

std::string("reporting.report_definition/") + boost::uuids::to_string(ctx.generate_uuid())

2.4. grantor_account_id

The account that gave the consent. A second create for the same party, resource and grantor returns this grant rather than a new one. 

ctx.generate_uuid()

2.5. role_id

The role a run token carries. At create and at every exchange, the grantor must hold every permission of this role in the party. 

ctx.generate_uuid()

2.6. audience

The service names that may exchange the grant, separated by commas, named by the service role each one's account holds, for example ReportingService,OreService,ComputeService. 

std::string("ReportingService")

2.7. max_runs

The number of runs the grant serves; zero for a standing grant. A manual run's grant serves one. 

0

2.8. not_after

The instant after which the grant serves no run; empty for a standing grant. 

std::chrono::system_clock::time_point{}

2.9. revoked_at

When the grant was revoked; empty while it is active. 

std::chrono::system_clock::time_point{}

2.10. revoked_by

Who revoked the grant: a username, or a service account. 

std::string("")

2.11. revoke_reason

Why the grant was revoked: unscheduled, deleted, party_changed or a person's reason. 

std::string("")

3. SQL

3.1. Flags

4. Foreign keys

4.1. grantor_account_id

4.2. role_id

5. C++

5.1. Flags

5.2. Repository

5.3. Domain includes

#include <string>
#include <boost/uuid/uuid.hpp>

5.4. Entity includes

#include <string>

5.5. Conventions

5.6. Table display

column header
resource Resource
audience Audience
modified_by Modified By
version Version

5.7. Presentation

5.7.1. Detail fields

field label widget type is_key is_required placeholder
resource Resource resourceEdit line_edit true true  
audience Audience audienceEdit line_edit   true  

5.7.2. Columns

enum_name field header type width
Resource resource Resource string 300
Audience audience Audience string 300
Version version Version int 70
ModifiedBy modified_by Modified By string 120
RecordedAt recorded_at Recorded At timestamp 150

6. See also

Emacs 29.3 (Org mode 9.6.15)