Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add example authorization capabilities for operations. #75

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Add example authorization capabilities for operations. #75

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
eb7c999
Add example authorization capabilities for operations.
dmitrizagidulin Sep 16, 2021
ad4a447
Update vault crud zCaps, remove others.
dmitrizagidulin Nov 11, 2021
9c8330d
Remove unneeded capabilityChain property.
dmitrizagidulin Nov 11, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
242 changes: 188 additions & 54 deletions index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -528,95 +528,229 @@ <h2>

<section class="normative">
<h2>
Operations
Operations and Authorization Structure
</h2>

<p>
Data vaults allow for the classic set of CRUD (Create, Read, Update and Delete)
operations on its data models.
All operations performed by an Encrypted Data Vault must carry appropriate
authorization. This section considers the structure (data model) of
authorizations in the context of operations they're authorizing.
</p>

<section class="normative">
<h3>
Create Operation
</h3>

<ul>
<li>
Create Vault: Creates/provisions an Encrypted Data Vault by specifying a
<code>DataVaultConfiguration</code> structure. This includes Replication configuration.
</li>
<li>
Create Index: Creates an Index for a particular Vault.
</li>
<li>
Create Resource (Document or Stream): Creates a Resource in a given Vault.
</li>
</ul>
<section class="normative">
<h4>
Create Vault
</h4>

<p>
This operation creates/provisions an Encrypted Data Vault instance by specifying
a <code>DataVaultConfiguration</code> structure (see the Encrypted Data Vault
Data Model section). This includes Replication configuration.
</p>

<pre class="example highlight"
title="Example authorization capability for a Create Vault operation.">
{
"@context": [
"https://w3id.org/security/v2",
"https://w3id.org/security/suites/ed25519-2020/v1"
],
"id": "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs",
"allowedAction": "write",
// entity on which the operation is performed
"invocationTarget": "https://example.com/edvs",
// DID used to prove possession (invoke the capability)
"controller": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
"proof": {
"type": "Ed25519Signature2020",
"created": "2021-11-11T20:30:40Z",
"verificationMethod": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
"proofPurpose": "capabilityInvocation",
"proofValue": "z3sLGvhHU..."
}
}
</pre>
</section>

<section class="normative">
<h4>
Create Resource
</h4>

<p>
This operation creates an encrypted resource (a Document with or without an
associated Stream), in a given vault instance.
</p>
</section>
</section>

<section class="normative">
<h3>
Read Operation
</h3>

<ul>
<li>
Read Vault Configuration: Returns the <code>DataVaultConfiguration</code> object
for a given Vault.
</li>
<li>
Read Index: Returns the Index configuration object.
</li>
<li>
Read Resource (Document or Stream): Returns the given resource.
</li>
</ul>
<section class="normative">
<h4>Read Vault Configuration</h4>

<p>
Returns the <code>DataVaultConfiguration</code> object for a given Vault.
</p>

<pre class="example highlight"
title="Example authorization capability for a Read Vault Config operation.">
{
"@context": [
"https://w3id.org/security/v2",
"https://w3id.org/security/suites/ed25519-2020/v1"
],
"id": "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs/z4sRgBJJLnYy",
"allowedAction": "read",
// entity on which the operation is performed
"invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy",
// DID used to prove possession (invoke the capability)
"controller": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
"proof": {
"type": "Ed25519Signature2020",
"created": "2021-11-11T20:30:40Z",
"verificationMethod": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
"proofPurpose": "capabilityInvocation",
"proofValue": "z3sLGvhHU..."
}
}
</pre>
</section>

<section class="normative">
<h4>Read Resource (Document or Stream)</h4>

<p>
Returns the requested encrypted resource.
</p>
</section>
</section>

<section class="normative">
<h3>
Update Operation
</h3>

<p class="issue">
Does an Update Index operation make sense?
</p>
<section class="normative">
<h4>Update Vault Configuration</h4>

<ul>
<li>
Update Vault Configuration: Modifies the <code>DataVaultConfiguration</code>
object for a given Vault.
</li>
<li>
Update Index: Modifies the Index configuration object.
</li>
<li>
Update Resource (Document or Stream): Updates the encrypted resource (note that
this is a "full replace" operation).
</li>
</ul>
<p>
Modifies the <code>DataVaultConfiguration</code> object for a given Vault.
</p>

<pre class="example highlight"
title="Example authorization capability for an Update Vault operation.">
{
"@context": [
"https://w3id.org/security/v2",
"https://w3id.org/security/suites/ed25519-2020/v1"
],
"id": "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs/z4sRgBJJLnYy",
"allowedAction": "write",
// entity on which the operation is performed
"invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy",
// DID used to prove possession (invoke the capability)
"controller": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
"proof": {
"type": "Ed25519Signature2020",
"created": "2021-11-11T20:30:40Z",
"verificationMethod": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
"proofPurpose": "capabilityInvocation",
"proofValue": "z3sLGvhHU..."
}
}
</pre>
</section>

<section class="normative">
<h4>Update Resource (Document or Stream)</h4>

<p>
Updates the encrypted resource (note that this is a "full replace" operation),
and any corresponding encrypted indexes.
</p>
</section>
</section>

<section class="normative">
<h3>
Delete Operation
</h3>

<p class="issue" data-number="114"></p>
<section class="normative">
<h4>Delete Vault</h4>

<ul>
<li>
Delete Vault Configuration: Deletes a Vault.
</li>
<li>
Delete Index: Deletes an Index.
</li>
<li>
Delete Resource (Document or Stream): Deletes the encrypted resource (note that
a tombstone object should remain behind for replication purposes).
</li>
</ul>
<p class="issue" data-number="21"></p>

<p>
Deletes a vault.
</p>

<pre class="example highlight"
title="Example authorization capability for a Delete Vault operation.">
{
"@context": [
"https://w3id.org/security/v2",
"https://w3id.org/security/suites/ed25519-2020/v1"
],
"id": "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs/z4sRgBJJLnYy",
"allowedAction": "write",
// entity on which the operation is performed
"invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy",
// DID used to prove possession (invoke the capability)
"controller": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
"proof": {
"type": "Ed25519Signature2020",
"created": "2021-11-11T20:30:40Z",
"verificationMethod": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
"proofPurpose": "capabilityInvocation",
"proofValue": "z3sLGvhHU..."
}
}
</pre>
</section>

<section class="normative">
<h4>Delete Resource (Document with or without an associated Stream)</h4>

<p class="issue" data-number="20"></p>

<p>
Deletes the encrypted resource (note that a tombstone object should remain
behind for replication purposes).
</p>
</section>
</section>

<section class="normative">
<h3>
Query Operation
</h3>

<section class="normative">
<h4>Query all Resources in a Vault</h4>

<p>
Requests all resources in a vault.
</p>

</section>

<section class="normative">
<h4>Query on an Encrypted Index Value</h4>

<p class="issue" data-number="37"></p>
</section>
</section>

<section class="normative">
Expand Down