|
|
@ -17,14 +17,16 @@ And these are joined by single space characters.
|
|
|
|
|
|
|
|
|
|
|
|
Specified caveats:
|
|
|
|
Specified caveats:
|
|
|
|
|
|
|
|
|
|
|
|
+-------------+--------------------------------------------------+--------------------------------------------------------------------------------------------+
|
|
|
|
+-------------+--------------------------------------------------+------------------------------------------------------------------------------------------------+
|
|
|
|
| Caveat name | Description | Legal Values |
|
|
|
|
| Caveat name | Description | Legal Values |
|
|
|
|
+-------------+--------------------------------------------------+--------------------------------------------------------------------------------------------+
|
|
|
|
+-------------+--------------------------------------------------+------------------------------------------------------------------------------------------------+
|
|
|
|
| gen | Generation of the macaroon caveat spec. | 1 |
|
|
|
|
| gen | Generation of the macaroon caveat spec. | 1 |
|
|
|
|
| user_id | ID of the user for which this macaroon is valid. | Pure equality check. Operator must be =. |
|
|
|
|
| user_id | ID of the user for which this macaroon is valid. | Pure equality check. Operator must be =. |
|
|
|
|
| type | The purpose of this macaroon. | access - used to authorize any action except token refresh |
|
|
|
|
| type | The purpose of this macaroon. | access - used to authorize any action except token refresh |
|
|
|
|
| refresh - only used to authorize a token refresh |
|
|
|
|
| refresh - only used to authorize a token refresh |
|
|
|
|
| time | Time before/after which this macaroon is valid. | A POSIX timestamp in milliseconds (in UTC). |
|
|
|
|
| time | Time before/after which this macaroon is valid. | A POSIX timestamp in milliseconds (in UTC). |
|
|
|
|
| Operator < means the macaroon is valid before the timestamp, as interpreted by the server. |
|
|
|
|
| Operator < means the macaroon is valid before the timestamp, as interpreted by the server. |
|
|
|
|
| Operator > means the macaroon is valid after the timestamp, as interpreted by the server. |
|
|
|
|
| Operator > means the macaroon is valid after the timestamp, as interpreted by the server. |
|
|
|
|
+-------------+--------------------------------------------------+--------------------------------------------------------------------------------------------+
|
|
|
|
| Operator == means the macaroon is valid at exactly the timestamp, as interpreted by the server.|
|
|
|
|
|
|
|
|
| Note that exact equality of time is largely meaningless. |
|
|
|
|
|
|
|
|
+-------------+--------------------------------------------------+------------------------------------------------------------------------------------------------+
|
|
|
|