Glossary
| Term | Meaning |
|---|---|
| Policy | IAM-style permission document (statements of Effect/Action/Resource/Condition), scoped by businessId. Collection policy. |
| Statement | One rule inside a policy: { Effect: Allow|Deny, Action: string[], Resource, Condition? }. |
| Role | Named bundle referencing policy _ids. Collection policyRoleMapping. |
| Condition | AWS IAM-style conditional block; 108 operators supported. |
| Policy Action | The GET /v1/policies/action result: a { roleName: [allow-policies] } map used by SSO/OIDC/Cognito. |
| Service Privilege Catalog | Master-seed listing of valid privilege strings per service (masterseeddata). |
| Privilege | An auth:* capability string checked during authorization (e.g. auth:createPolicy). |
businessId |
Integer tenant identifier scoping policies and roles. |
preauth |
The shared JWT-auth check that validates the token and confirms a privilege. |
isAdmin |
Flag on the caller’s token required in addition to the privilege. |
appPrefix |
Optional route prefix /- used only in serverless + custom-domain deployments. |
| In-memory mode | AUTH_USE_INMEMORY=true — MongoDB replaced by an in-memory adapter for local/testing. |
EQ-POL / EQ-PRL / EQ-USR / EQ-SED |
Error-code domains: Policy / Policy-Role mapping / JWT-auth / Service-seed-data. |
Revision History
2026-08-05 | AN – Page created and uploaded the contents