| Name | Type | Description | Notes |
|---|---|---|---|
| allowed_resource_actions | string[] | Set of tasks that can be performed on a resource. Required. The following is the schema for resource actions: ``` {Namespace}/{Entity}/{PropertySet}/{Action} ``` For example: `libre.graph/applications/credentials/update` * {Namespace} - The services that exposes the task. For example, all tasks in libre graph use the namespace `libre.graph`. * {Entity} - The logical features or components exposed by the service in libre graph. For example, `applications`, `servicePrincipals`, or `groups`. * {PropertySet} - Optional. The specific properties or aspects of the entity for which access is being granted. For example, `libre.graph/applications/authentication/read` grants the ability to read the reply URL, logout URL, and implicit flow property on the application object in libre graph. The following are reserved names for common property sets: * `allProperties` - Designates all properties of the entity, including privileged properties. Examples include `libre.graph/applications/allProperties/read` and `libre.graph/applications/allProperties/update`. * `basic` - Designates common read properties but excludes privileged ones. For example, `libre.graph/applications/basic/update` includes the ability to update standard properties like display name. * `standard` - Designates common update properties but excludes privileged ones. For example, `libre.graph/applications/standard/read`. * {Actions} - The operations being granted. In most circumstances, permissions should be expressed in terms of CRUD operations or allTasks. Actions include: * `create` - The ability to create a new instance of the entity. * `read` - The ability to read a given property set (including allProperties). * `update` - The ability to update a given property set (including allProperties). * `delete` - The ability to delete a given entity. * `allTasks` - Represents all CRUD operations (create, read, update, and delete). Following the CS3 API we can represent the CS3 permissions by mapping them to driveItem properties or relations like this: | CS3 ResourcePermission |
| condition | string | Optional constraints that must be met for the permission to be effective. Not supported for custom roles. Conditions define constraints that must be met. For example, a requirement that target resource must have a certain property. The following are the supported conditions: * Drive: `exists @Resource.Drive` - The target resource must be a drive/space * Folder: `exists @Resource.Folder` - The target resource must be a folder * File: `exists @Resource.File` - The target resource must be a file The following is an example of a role permission with a condition that the target resource is a folder: ```json "rolePermissions": [ { "allowedResourceActions": [ "libre.graph/applications/basic/update", "libre.graph/applications/credentials/update" ], "condition": "exists @Resource.File" } ] ``` Conditions aren't supported for custom roles. | [optional] |