ManifestBuilder
in package
Fluent construction of a {@see ManagementManifest} (CONTRACT.md §27.6).
One method per ManifestKind, each taking the manifest-local key first so a declaration reads as "this thing, called this, looks like this". Nothing here talks to the server: a builder produces a description, and describing a tenant is not the same act as changing one.
Table of Contents
Methods
- build() : ManagementManifest
- Finishes the manifest.
- group() : self
- Declares a group and the roles assigned to it.
- permission() : self
- Declares a permission.
- resource() : self
- Declares a resource.
- role() : self
- Declares a role and the permissions granted to it.
Methods
build()
Finishes the manifest.
public
build() : ManagementManifest
Validates before returning, so an incoherent manifest is rejected at the point it was written rather than at the point somebody applies it.
Tags
Return values
ManagementManifestgroup()
Declares a group and the roles assigned to it.
public
group(string $key, string $name, string $description[, array<int, string> $roleKeys = [] ][, array<string, mixed> $metadata = [] ]) : self
Parameters
- $key : string
-
Manifest-local identity.
- $name : string
-
The group's name.
- $description : string
-
Human-readable description.
- $roleKeys : array<int, string> = []
-
Keys of roles this group carries.
- $metadata : array<string, mixed> = []
-
Free-form metadata.
Return values
selfpermission()
Declares a permission.
public
permission(string $key, string $action, string $description) : self
Parameters
- $key : string
-
Manifest-local identity.
- $action : string
-
The action this permission names (e.g.
documents:read). - $description : string
-
Human-readable description.
Return values
selfresource()
Declares a resource.
public
resource(string $key, string $name, string $type[, string|null $parentKey = null ][, array<string, mixed> $metadata = [] ]) : self
Parameters
- $key : string
-
Manifest-local identity.
- $name : string
-
The resource's name.
- $type : string
-
Its
resource_type. - $parentKey : string|null = null
-
The KEY of the parent resource, not its UUID — a manifest cannot know a UUID that does not exist yet.
- $metadata : array<string, mixed> = []
-
Free-form metadata.
Return values
selfrole()
Declares a role and the permissions granted to it.
public
role(string $key, string $name, string $description[, bool $isGlobal = false ][, array<string, string> $grants = [] ]) : self
$grants maps a permission KEY to its effect — 'allow' or 'deny'. AXIAM's RBAC
is DENY-OVERRIDE, not most-specific-wins: an explicit deny beats every allow, at any
depth of the resource hierarchy and at equal specificity. A deny grant here is
therefore a strong statement, not a default that a narrower allow can reverse.
Parameters
- $key : string
-
Manifest-local identity.
- $name : string
-
The role's name.
- $description : string
-
Human-readable description.
- $isGlobal : bool = false
-
Whether the role applies tenant-wide.
- $grants : array<string, string> = []
-
Permission key =>
allow|deny.