Lexicon Garden

space.highport.manage.grantSpaceAccess

Hand bard a delegation token so it can keep reading a space. Any member may grant; the calling identity must be the token's issuer. Bard exchanges it under its own key, stores the credential, renews the notification registration when due, drains a queued receipt, and runs a head check if the space had lapsed.

Repository @lexicons.highport.space did:plc:ciygg5hma4q7ah2kxaszkyob namespace authority
Details · procedure
Kindprocedure
Authoritymanage.highport.space
Indexed

Showing version bafyreidbvvlptqgvhunon524yanqeftaac6uvtdkdbw33epxpbczzhozde. Show the latest

Compare Edit in builder → Fork →

Procedure

procedure · POST

Input

application/json

delegationToken

requiredstring

A delegation token minted by the calling identity for this space; spent immediately and never stored.

space

requiredstring · at-uri

Output

application/json

accessExpiresAt

requiredstring · datetime

When the credential bard now holds expires.

drained

requiredinteger

Queued notification receipts turned into sync jobs by this grant.

registrationExpiresAt

string · datetime

When bard's notification registration at the space host expires.

Errors

SpaceNotFound

Bard is not connected to that space; call connectSpace first.

GrantIssuerMismatch

The delegation token's issuer is not the calling identity.

GrantExpired

The delegation token is past its lifetime.

GrantRefused

The space host refused the exchange.

AppNotAllowed

The space's app access does not admit bard.

SpacesDisabled

Space support is disabled on this deployment.

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • space.highport.manage.connectSpace

    procedure

    Connect a space so bard can read and publish the authority's site and tile records from it. Only the authority can call this, with a delegation token it issued. Bard trades the token for a credential, registers for notifications, and pulls the authority's repo. Safe to repeat.

  • social.colibri.beta.actor.grantSpaceAccess

    procedure

    Hands the AppView access to one of the requesting user's personal spaces. The client mints a delegation token on its own PDS for the space and passes it here, because a delegation token is single-use and short-lived and the AppView has no OAuth session of its own. The AppView exchanges the token for a space credential and syncs the space.

  • zone.stratos.space.getSpaceCredential

    procedure

    Issue a space credential (JWT) for a space the caller is a member of. The credential is multi-use until it expires and is bound to the caller's DPoP key (cnf.jkt, RFC 9449): it must be presented under the DPoP auth scheme with a per-request proof signed by that key. It is signed by the space authority's signing key so any repo host can verify it without contacting the authority. Identity is resolved from a delegation token when provided (a standalone DPoP proof in the DPoP header supplies the ke

  • space.highport.manage.getSpace

    query

    What bard knows about a connected space: its sync state, when bard's credential expires, and its counts. Available to the space's authority and to viewers (identities with a grant inside the viewer window).