ConnectPolicy connect.policy@1

Generated at from openvibe-contracts v0.419.0 and openvibe-sdk v0.161.0.

Version
1.0.0
Owner
connect
Visibility
first-party
Status
active
Compatibility
backward
Schema
https://openvibe.network/contracts/connect/policy.v1.json

connect.policy@1: the grants, routes and exit-node settings of one private Connect tenant. It is deliberately tenant-scoped: a rule never names a device, person or tag from another tenant, and default_action is deny unless the owner opens a path. It describes intent, not the control plane's internal ACL file or keys.

Fields

FieldTypeRequiredDescriptionConstraints
idstringyes
  • pattern ^pol_[0-9A-HJKMNP-TV-Z]{26}$
owneridentity.subject-refyes
project_idstring | null
  • pattern ^prj_[0-9A-HJKMNP-TV-Z]{26}$
tenantone ofyesThe one tenant this policy can affect; a rule or route naming another tenant's id is invalid.
namestring
  • minLength 1
  • maxLength 80
versionintegeryesBumped on every change; a device keeps the version it last applied.
  • minimum 1
default_actionenumyesdeny unless the owner explicitly opens a path.
  • one of "allow", "deny"
rulesarray of objectyes
  • maxItems 200
  • items: no other fields
rules[].actionenumyes
  • one of "allow", "deny"
rules[].sourceshttps://openvibe.network/contracts/connect/policy.v1.json#/$defs/selectoryes
  • minItems 1
  • maxItems 50
rules[].destinationshttps://openvibe.network/contracts/connect/policy.v1.json#/$defs/selectoryes
  • minItems 1
  • maxItems 50
rules[].portshttps://openvibe.network/contracts/connect/policy.v1.json#/$defs/portTCP/UDP ports or ranges; omit for all ports.
  • maxItems 50
rules[].descriptionstring
  • maxLength 200
exit_nodeobject | nullExit nodes are usable only by this tenant's devices; no public share may target one.
subnet_routesarray of object
  • maxItems 100
  • items: no other fields
subnet_routes[].device_idstringyes
  • pattern ^dev_[0-9A-HJKMNP-TV-Z]{26}$
subnet_routes[].cidrstringyes
  • minLength 2
  • maxLength 64
updated_byidentity.subject-ref
created_atstringyes
  • format date-time
updated_atstringyes
  • format date-time

Examples

From the contract's own test fixtures: valid ones validate, rejected ones must fail.

Valid: home-mesh
{
  "id": "pol_01J8Z3Q4R5S6T7V8W9X0Y1Z2A4",
  "owner": {
    "type": "user",
    "id": "usr_01J8Z3Q4R5S6T7V8W9X0Y1Z2A6"
  },
  "project_id": null,
  "tenant": {
    "type": "user",
    "id": "usr_01J8Z3Q4R5S6T7V8W9X0Y1Z2A6"
  },
  "name": "Home mesh",
  "version": 2,
  "default_action": "deny",
  "rules": [
    {
      "action": "allow",
      "sources": [
        "device:dev_01J8Z3Q4R5S6T7V8W9X0Y1Z2A8"
      ],
      "destinations": [
        "device:dev_01J8Z3Q4R5S6T7V8W9X0Y1Z2A8"
      ],
      "ports": [
        "443",
        "8000-8100"
      ],
      "description": "The owner's own devices reach each other."
    }
  ],
  "exit_node": {
    "enabled": false,
    "device_ids": []
  },
  "subnet_routes": [
    {
      "device_id": "dev_01J8Z3Q4R5S6T7V8W9X0Y1Z2A8",
      "cidr": "192.168.1.0/24"
    }
  ],
  "updated_by": {
    "type": "user",
    "id": "usr_01J8Z3Q4R5S6T7V8W9X0Y1Z2A6"
  },
  "created_at": "2026-10-29T08:00:00.000Z",
  "updated_at": "2026-10-29T09:00:00.000Z"
}
Rejected: bad-port
{
  "id": "pol_01J8Z3Q4R5S6T7V8W9X0Y1Z2A4",
  "owner": {
    "type": "user",
    "id": "usr_01J8Z3Q4R5S6T7V8W9X0Y1Z2A6"
  },
  "tenant": {
    "type": "user",
    "id": "usr_01J8Z3Q4R5S6T7V8W9X0Y1Z2A6"
  },
  "version": 1,
  "default_action": "deny",
  "rules": [
    {
      "action": "allow",
      "sources": [
        "*"
      ],
      "destinations": [
        "*"
      ],
      "ports": [
        "http"
      ]
    }
  ],
  "created_at": "2026-10-29T08:00:00.000Z",
  "updated_at": "2026-10-29T09:00:00.000Z"
}
Rejected: bad-selector
{
  "id": "pol_01J8Z3Q4R5S6T7V8W9X0Y1Z2A4",
  "owner": {
    "type": "user",
    "id": "usr_01J8Z3Q4R5S6T7V8W9X0Y1Z2A6"
  },
  "tenant": {
    "type": "user",
    "id": "usr_01J8Z3Q4R5S6T7V8W9X0Y1Z2A6"
  },
  "version": 1,
  "default_action": "deny",
  "rules": [
    {
      "action": "allow",
      "sources": [
        "everyone"
      ],
      "destinations": [
        "*"
      ]
    }
  ],
  "created_at": "2026-10-29T08:00:00.000Z",
  "updated_at": "2026-10-29T09:00:00.000Z"
}

Validate

const contracts = require('openvibe-contracts');
contracts.validate('connect.policy@1', value);   // { valid, errors: [{ path, message }] }