AuthorizationReachView

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/picaos/main/json-schema/picaos-authorization-reach-view-schema.json",
  "title": "AuthorizationReachView",
  "description": "What one app reaches in one environment, as the manage page reads it.\n\n**Deliberately not folded into a single view.** A grant is per environment,\nand `Full` in one says nothing about the other: merging them would report a\nnarrowed live grant as unrestricted the moment a sandbox grant sat beside\nit, and drop every account the user came to edit. Keeping them apart is also\nwhat lets the page say which environment a level belongs to, which is the\nquestion a single merged answer cannot even express.",
  "x-generated": "2026-10-21",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/_original/picaos-api-openapi.json#/components/schemas/AuthorizationReachView",
  "properties": {
    "environment": {
      "$ref": "#/$defs/SecretKeyEnvironment"
    },
    "reach": {
      "description": "What a grant reaches, generic over how each entry is rendered - the one\ntrichotomy two surfaces share: a dashboard reads it as counts\n([`GrantedReachView`]), a reconnect card as pre-selectable rules\n([`PriorGrantView`]). `KnowledgeOnly`/`Full` are identical on the wire for\nboth; only the `Connectors` element type differs.\n\nA bare generic derives a single schema named `ReachView`, so both\ninstantiations would collide on that one OpenAPI component and one endpoint\nwould advertise the other's connector shape. Every schema site that carries\none of these therefore inlines it (`#[schema(inline)]` / `inline(...)`), so\nno shared `ReachView` component exists to collide.",
      "oneOf": [
        {
          "description": "Docs and search only: no connection access of any kind.",
          "properties": {
            "type": {
              "enum": [
                "knowledgeOnly"
              ],
              "type": "string"
            }
          },
          "required": [
            "type"
          ],
          "type": "object"
        },
        {
          "description": "Every connection in the consented scope. No connector list because the\ngrant names none - it follows the account.",
          "properties": {
            "type": {
              "enum": [
                "full"
              ],
              "type": "string"
            }
          },
          "required": [
            "type"
          ],
          "type": "object"
        },
        {
          "description": "Only what the grant names, each entry rendered as `C`. **The granularity\nis the instantiation's**: a reach report carries one entry per\nconnector, a prior grant one per granted *connection*, so two entries\nthere can share a connector.",
          "properties": {
            "connectors": {
              "items": {
                "$ref": "#/$defs/PriorGrantConnectorView"
              },
              "type": "array"
            },
            "type": {
              "enum": [
                "connectors"
              ],
              "type": "string"
            }
          },
          "required": [
            "connectors",
            "type"
          ],
          "type": "object"
        }
      ]
    }
  },
  "required": [
    "environment",
    "reach"
  ],
  "type": "object",
  "$defs": {
    "SecretKeyEnvironment": {
      "enum": [
        "test",
        "live"
      ],
      "type": "string"
    }
  }
}