Payload class

Amend the non-role attributes of an existing ACL entry: its label, scopes, allowed keys, expiry, step-up requirement, or approve-authority. Role changes are NOT expressible here — they go through acl/change-role, which requires the current role as a compare-and-swap.

Constructors

Payload({required String subject, String? label, List<String>? scopes, List<String>? allowedKeys, String? expiresAt, PayloadStepUp? stepUp, PayloadApprove? approve, String? reason, Ext? ext})
const
Payload.fromJson(Map<String, dynamic> json)
Read this payload from a decoded JSON object.
factory

Properties

allowedKeys → List<String>?
Replacement key filter, applied wholesale rather than merged (the entry's allowedKeys becomes exactly this value). Omitted leaves the filter unchanged. Explicit null REMOVES the filter — the subject may once again reach every key within its scopes, a privilege increase a consumer SHOULD gate like clearing expiresAt. An EMPTY ARRAY sets the filter to no keys at all — the narrowest grant, not a wildcard. A replacement that narrows the previous filter IS a privilege reduction: unlike scopes (whose narrowing is refused here and routed to acl/revoke) it is accepted, because acl/revoke/0.1 cannot express a per-key reduction — but the consumer MUST audit it as a reduction and apply it to the subject's live sessions rather than letting the wider set survive until a credential expires.
final
approve → PayloadApprove?
Replacement approve-authority — what the subject may CONFER on others, as distinct from what it may exercise. Granting or widening this is an escalation vector (a subject able to confer can manufacture an approver for an operation it could not authorize), so a consumer SHOULD gate it more strictly than the other members here.
final
expiresAt → String?
Replacement expiry. Explicit null makes the entry permanent — a privilege increase, which a consumer SHOULD gate at least as strictly as the original grant.
final
ext → Ext?
final
hashCode → int
The hash code for this object.
no setterinherited
label → String?
Replacement human-readable label. Explicit null clears it. Omitted leaves it unchanged.
final
reason → String?
Optional human-readable rationale, recorded with the change.
final
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited
scopes → List<String>?
Replacement scope set, applied wholesale rather than merged — a caller that means to add one sends the full intended set. NARROWING THE SET IS A REVOCATION and a consumer MUST refuse it here, directing the caller to acl/revoke, so that every removal of authority passes through the task that is audited and reasoned as a revocation.
final
stepUp → PayloadStepUp?
Replacement per-entry step-up configuration. Same additive-only rule as on the entry itself: it MAY raise the assurance required of this subject above the system floor but MUST NOT lower it.
final
subject → String
VID of the entry to amend. The entry MUST already exist; this task does not create one (use acl/grant).
final

Methods

noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
toJson() → Map<String, dynamic>
Serialize to a JSON-encodable map, omitting absent members.
toString() → String
A string representation of this object.
inherited

Operators

operator ==(Object other) → bool
The equality operator.
inherited