nip46_authorization.v1.json (1971B)
1 { 2 "schema": "radroots.myc.nip46-authorization.v1", 3 "contract_version": 1, 4 "prerequisites": ["nip46_replay.v1", "myc_state_schema_v5"], 5 "policy_authority": "normalized_configuration_bound_in_myc_state_metadata", 6 "admission_precedence": [ 7 "configured_denied_client_is_direct_denial_without_connection_or_rate_window", 8 "configured_trusted_client_is_active_only_with_permissions_within_ceiling_and_bounded_authorization_lifetime", 9 "configured_trusted_and_unknown_client_admissions_consume_global_and_relay_rate_windows", 10 "all_unknown_clients_require_explicit_operator_approval" 11 ], 12 "permissions": { 13 "ceiling": "exact_normalized_configuration_permission_ceiling", 14 "sign_event_kind_width": "u32", 15 "operator_grant": "subset_of_requested_and_configured_ceiling", 16 "client_metadata_authority": "none" 17 }, 18 "challenges": { 19 "enabled": "exact_normalized_configuration_switch", 20 "url": "exact_operator_configured_url_only", 21 "pending_lifetime": "positive_and_not_greater_than_configured_pending_lifetime_ms", 22 "authorized_lifetime": "positive_and_not_greater_than_configured_authorized_lifetime_ms", 23 "creation_rate_window": "configuration_bound_connection_scope", 24 "authorization_rate_window": "separate_configuration_bound_connection_scope", 25 "terminal_replay": "exact_and_state_bound" 26 }, 27 "rate_windows": { 28 "unknown_connection_admission": "global_and_configured_relay_subjects", 29 "arbitrary_client_subject_rows": "forbidden_before_connection", 30 "retention": "exact_configuration_bound_per_class", 31 "saturated_replay": "stable" 32 }, 33 "durable_authority": { 34 "owner": "existing_myc_state_repository_and_service_sqlite_transaction", 35 "new_store_or_limiter": "forbidden", 36 "configuration_bypass": "rejected_before_transaction" 37 }, 38 "nonclaims": [ 39 "ciphertext_decryption", 40 "supported_method_admission", 41 "provider_execution", 42 "response_commit", 43 "relay_publication" 44 ] 45 }