Commit afc05748 authored by Dimitrios Gogos's avatar Dimitrios Gogos
Browse files

docs: clarify API product and product grant definitions in glossary and ADR-0048

parent 963a6ebf

decisions/0048-platform-roles.md

+6 −3
Changes for decisions/0048-platform-roles.md: 6 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -56,9 +56,12 @@ per operation, and `api_subscriptions`, a table OEG never populates. 
   portal. `manage-users` can map any realm role, so the portal must restrict which roles its

   admin pages offer.

5. **API access is granted per API product.**

   - The API products are `edge-application-management`, `quality-on-demand`,

     `location-retrieval` and `traffic-influence`. Each is a client role of the same name on the

     `oeg` client. Client roles, so decision 1 still holds.

   - An API product is what OEG offers and an application is entitled to (OEG's API Product

     Catalog: an API with its policy and quota). In Release 2 there are four, each one CAMARA API:

     `edge-application-management`, `quality-on-demand`, `location-retrieval` and

     `traffic-influence`. A product is enforced through its CAMARA scopes, and its quota and

     policy are not enforced yet. Each product is a client role of the same name on the `oeg`

     client. Client roles, so decision 1 still holds.

   - Each CAMARA client scope has a role scope mapping to its product's role. Keycloak puts a scope

     in a token only when the user, or the service account behind a client, holds that role. OEG

     keeps checking scopes per operation and knows nothing about products.

platform/glossary.md

+3 −2
Changes for platform/glossary.md: 3 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -117,9 +117,9 @@ This is the single glossary for all Open Operator Platform (OOP) architecture do 


| Term | Meaning |

|------|---------|

| **API product** | One exposed CAMARA API offered as a unit: `edge-application-management`, `quality-on-demand`, `location-retrieval`, `traffic-influence`. Each maps to a fixed set of CAMARA scopes |

| **API product** | What OEG offers and an application is entitled to: a published API with its policy and quota (OEG's API Product Catalog). In Release 2 there are four, each one CAMARA API (`edge-application-management`, `quality-on-demand`, `location-retrieval`, `traffic-influence`); quota and policy are not enforced yet, and access is enforced through the product's fixed set of CAMARA scopes (ADR-0048) |

| **App Provider** | The upstream client using OEG's northbound APIs |

| **Product grant** | Permission for a user or client to call one API product: a product role on the `oeg` client that gates that product's CAMARA scopes (ADR-0048) |

| **Product grant** | Permission for a user or client to use one API product, enforced as a product role on the `oeg` client that gates the product's CAMARA scopes (ADR-0048) |

| **Callback** | An outbound CloudEvent (`application/cloudevents+json`) from OEG to an App Provider's registered sink when an async operation reaches a terminal state; authenticated with `Authorization: Bearer` using the request's `sinkCredential` (ADR-0008). `operationId` is never included in the callback payload. |

| **Catalog** | Read-side metadata describing what products, specifications, or templates are available |

| **Inventory** | The authoritative record of deployed or provisioned services and resources. SRM owns this truth, not OEG. |
@@ -158,3 +158,4 @@ This is the single glossary for all Open Operator Platform (OOP) architecture do 
| 2.0 | 2026-08-05 | Capability instance entry corrected: `external_ref` is the backend realization ref, not a caller-facing id — caller-facing identity lives on `service_instance.id` for every family (ADR-0033). |

| 2.0 | 2026-09-01 | Placement, Network Domain, and Control path binding entries note the device-targeted control-path-probe exception (no zone/domain pin; adapter probing, ADR-0038/ADR-0040) and TF-SDK's adapter factory (ADR-0041). |

| 2.0 | 2026-10-04 | API product entry names the four products; new Product grant entry; Subscription marked reserved for quota and validity (ADR-0048). |

| 2.0 | 2026-10-05 | API product entry defined as what OEG offers (API, policy, quota), not as its scopes; scopes are how Release 2 enforces it (ADR-0048). |