TeaAccessPolicy

Who may read one published TEA object: a product, a component or a release’s collection. This is the Vulnetix publication overlay’s access policy; the TEA consumption API itself does not say who may fetch what. The policy in force for any object is the narrowest one declared anywhere from the object up to its product, so a private product keeps everything beneath it private whatever those objects declare, and widening the product back restores each one to its own declaration. Plan refuses a policy wider than the one its parent enforces. An object no policy covers is private. Removing the document removes the declaration, and the object inherits from its parent again; for a product or component that means private. Mirroring to other TEA servers (publishTo in the publisher API) is not part of this kind, because this server does not mirror yet.

apiVersion	vulnetix.com/v1
kind	TeaAccessPolicy
Group	TEA
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists TeaAccessPolicy in its kinds. See Management tokens.
Applied after	TeaProduct, TeaComponent, TeaCollection (deleted before them)
Terraform resource	vulnetix_tea_access_policy, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.168.0 and later.
Pinned schema	v1.15.0/TeaAccessPolicy.schema.json
Newest schema	latest/TeaAccessPolicy.schema.json
First released in	v1.6.0
Print the built-in copy	vulnetix config schema TeaAccessPolicy

Minimal

Only the fields the kind requires. From examples/TeaAccessPolicy/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaAccessPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: TeaAccessPolicy
metadata:
  name: acme-payments
spec:
  product: acme-payments
  visibility: private

HCL (resource vulnetix_tea_access_policy)

# Only the arguments the kind requires. From config-schemas examples/TeaAccessPolicy/minimal.yaml.

resource "vulnetix_tea_access_policy" "acme_payments" {
  name       = "acme-payments"
  product    = "acme-payments"
  visibility = "private"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaAccessPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: TeaAccessPolicy
metadata:
  name: acme-payments
spec:
  product: acme-payments
  visibility: private
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/TeaAccessPolicy/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaAccessPolicy.schema.json
# The product is public, one component is shared with a customer under
# contract, and one release's collection is embargoed. The narrowest policy
# on the way up from an object to its product is the one in force.
apiVersion: vulnetix.com/v1
kind: TeaAccessPolicy
metadata:
  name: acme-payments
  annotations:
    approved-by: https://tracker.example.com/SEC-210
spec:
  product: acme-payments
  visibility: public
  confirmPublic: true
---
apiVersion: vulnetix.com/v1
kind: TeaAccessPolicy
metadata:
  name: payments-api
spec:
  component: payments-api
  visibility: shared
  sharedWith:
    - organization: 6f1c2a8e-3b4d-4e5f-8a9b-0c1d2e3f4a5b
      organizationName: Globex Corporation
      expires: 2027-06-30T00:00:00Z
---
apiVersion: vulnetix.com/v1
kind: TeaAccessPolicy
metadata:
  name: acme-payments-2-4-0
spec:
  collection: acme-payments-2-4-0
  visibility: private

HCL (resource vulnetix_tea_access_policy)

# Every argument the kind supports. From config-schemas examples/TeaAccessPolicy/advanced.yaml.

resource "vulnetix_tea_access_policy" "acme_payments" {
  name           = "acme-payments"
  confirm_public = true
  product        = "acme-payments"
  visibility     = "public"
  annotations = {
    approved-by = "https://tracker.example.com/SEC-210"
  }
}

resource "vulnetix_tea_access_policy" "payments_api" {
  name      = "payments-api"
  component = "payments-api"
  shared_with = [
    {
      expires           = "2027-06-30T00:00:00Z"
      organization      = "6f1c2a8e-3b4d-4e5f-8a9b-0c1d2e3f4a5b"
      organization_name = "Globex Corporation"
    },
  ]
  visibility = "shared"
}

resource "vulnetix_tea_access_policy" "acme_payments_2_4_0" {
  name       = "acme-payments-2-4-0"
  collection = "acme-payments-2-4-0"
  visibility = "private"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaAccessPolicy.schema.json
# The product is public, one component is shared with a customer under
# contract, and one release's collection is embargoed. The narrowest policy
# on the way up from an object to its product is the one in force.
apiVersion: vulnetix.com/v1
kind: TeaAccessPolicy
metadata:
  name: acme-payments
  annotations:
    approved-by: https://tracker.example.com/SEC-210
spec:
  product: acme-payments
  visibility: public
  confirmPublic: true
---
apiVersion: vulnetix.com/v1
kind: TeaAccessPolicy
metadata:
  name: payments-api
spec:
  component: payments-api
  visibility: shared
  sharedWith:
    - organization: 6f1c2a8e-3b4d-4e5f-8a9b-0c1d2e3f4a5b
      organizationName: Globex Corporation
      expires: 2027-06-30T00:00:00Z
---
apiVersion: vulnetix.com/v1
kind: TeaAccessPolicy
metadata:
  name: acme-payments-2-4-0
spec:
  collection: acme-payments-2-4-0
  visibility: private
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly TeaAccessPolicy	Always TeaAccessPolicy.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.product	string	no		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The metadata.name of a TeaProduct the policy applies to.
spec.component	string	no		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The metadata.name of a TeaComponent the policy applies to.
spec.collection	string	no		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The metadata.name of a TeaCollection the policy applies to. It covers the artifacts in the collection, and is narrowed by the policy of the release’s product or component.
spec.visibility	string	yes		private, shared, public	private: only this organisation may read the object. shared: this organisation and the organisations in sharedWith may read it, and readers must authenticate. public: anyone may read it without authenticating. Public cannot be taken back in practice, because whatever was fetched while it was public stays fetched, so it also needs confirmPublic.
spec.sharedWith	array of object	no			The organisations entitled to read the object while visibility is shared. Allowed only with shared, so that a later change to private cannot leave a grant standing. Where several levels of the tree declare shared, a reader needs a grant at every level and the earliest expiry applies.
spec.sharedWith[].organization	string	yes		format uuid	The reading organisation’s UUID on this server, the identity it authenticates as.
spec.sharedWith[].organizationName	string	no		length 1 to 256	The organisation’s display name, for whoever reviews the grants. Advisory only: the UUID is the identity, so a rename never moves a grant.
spec.sharedWith[].expires	string	no		format date-time, or format date	When the grant lapses, such as the end of an evaluation or a contract. Left out, the grant lasts until it is removed.
spec.confirmPublic	boolean	no			Required, and true, when visibility is public: the document’s author confirms the object is meant for the open web. The publisher API asks for the same confirmation with ?confirm=public.

Rules

Conditions the schema enforces beyond each field’s own type. vulnetix config validate and the engine’s plan report a document that breaks one.

On	Rule
spec	When visibility is public: confirmPublic is required and confirmPublic must be true.
spec	Exactly one of product, component or collection is set.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Order. Applied after TeaProduct, TeaComponent and TeaCollection, so a document that refers to one by metadata.name can be in the same apply. Deleted before them.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.

How apply treats it

Set as the publisher API sets it, refusing a policy wider than its parent enforces. Grants are replaced.

Terraform and OpenTofu

The resource is vulnetix_tea_access_policy in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_tea_access_policy.

Import an object that already exists by its name:

# Import an existing TeaAccessPolicy by its name (metadata.name).
terraform import vulnetix_tea_access_policy.acme_payments acme-payments

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.