انتقل إلى المحتوى الرئيسي

Variable: ActorTokenClaims

const ActorTokenClaims: TObject<{ aud: TString; exp: TInteger; iat: TInteger; jti: TString; oktoid:roles: TArray<TString>; oktoid:scope: TString; oktoid:tenant: TString; sub: TString; }>

Defined in: packages/contracts/src/actor-token.ts:137

The claims of an actor token: a proof of what the gateway authenticated, for one message. Every claim is checked against the envelope it travels in, and a token is useless on any other message, on any other subject, and after its deadline:

  • sub is the actor's subjectId, or ACTOR_TOKEN_PLATFORM_SUBJECT for the platform actor;
  • oktoid:tenant, oktoid:scope and oktoid:roles are the actor's tenant, scope path and roles;
  • jti is the envelope's messageId;
  • aud is the registry key of the subject the message is sent on;
  • exp is the envelope's deadline and iat its issuedAt, in seconds since the epoch.

It is not a bearer credential and not an access token. It names no module: on the in-process path the transport supplies callerModule, and on the broker path a module edge is not yet provable (D2.2), so callerModule is refused there.