{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://ver.cy/models/wm-xct-036-alias-same-as-mapping/profiles/enterprise-identity/0.1.0/identity-profile.schema.json",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "format": {
      "const": "vercy-enterprise-identity-assertion"
    },
    "version": {
      "const": "0.1.0"
    },
    "id": {
      "type": "string",
      "minLength": 1,
      "maxLength": 1024,
      "format": "uri",
      "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
    },
    "dimension": {
      "type": "string",
      "minLength": 1,
      "maxLength": 1024,
      "format": "uri",
      "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
    },
    "purpose": {
      "type": "string",
      "minLength": 1,
      "maxLength": 1024
    },
    "policyDigest": {
      "type": "string",
      "pattern": "^sha256:[0-9a-f]{64}$"
    },
    "binding": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "assignmentId": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "scheme": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "schemeVersion": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024
        },
        "issuer": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "scope": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "value": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024
        },
        "comparison": {
          "const": "exact-string"
        },
        "kind": {
          "enum": [
            "person",
            "organization",
            "user-account",
            "service-account"
          ]
        },
        "validFrom": {
          "type": "string",
          "format": "date-time",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
        },
        "validTo": {
          "anyOf": [
            {
              "type": "string",
              "format": "date-time",
              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
            },
            {
              "type": "null"
            }
          ]
        },
        "recordedAt": {
          "type": "string",
          "format": "date-time",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
        },
        "sourceRecord": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "sourceReferentRef": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "personalDataClass": {
          "enum": [
            "synthetic",
            "restricted"
          ]
        },
        "credentialProhibition": {
          "const": true
        }
      },
      "required": [
        "assignmentId",
        "scheme",
        "schemeVersion",
        "issuer",
        "scope",
        "value",
        "comparison",
        "kind",
        "validFrom",
        "validTo",
        "recordedAt",
        "sourceRecord",
        "sourceReferentRef",
        "personalDataClass",
        "credentialProhibition"
      ]
    },
    "target": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "kind": {
          "enum": [
            "person",
            "organization",
            "user-account",
            "service-account"
          ]
        }
      },
      "required": [
        "id",
        "kind"
      ]
    },
    "relation": {
      "enum": [
        "equivalent-in-context",
        "not-same-assertion",
        "probable-entity-match"
      ]
    },
    "endpointResolution": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "source": {
          "enum": [
            "resolved",
            "unresolved",
            "ambiguous"
          ]
        },
        "target": {
          "enum": [
            "resolved",
            "unresolved",
            "ambiguous"
          ]
        }
      },
      "required": [
        "source",
        "target"
      ]
    },
    "validFrom": {
      "type": "string",
      "format": "date-time",
      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
    },
    "validTo": {
      "anyOf": [
        {
          "type": "string",
          "format": "date-time",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
        },
        {
          "type": "null"
        }
      ]
    },
    "inferencePermitted": {
      "const": false
    },
    "history": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "properties": {
          "id": {
            "type": "string",
            "minLength": 1,
            "maxLength": 1024,
            "format": "uri",
            "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
          },
          "previousDigest": {
            "type": "string",
            "pattern": "^sha256:[0-9a-f]{64}$"
          },
          "recordedAt": {
            "type": "string",
            "format": "date-time",
            "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
          },
          "effectiveAt": {
            "type": "string",
            "format": "date-time",
            "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
          },
          "actor": {
            "type": "string",
            "minLength": 1,
            "maxLength": 1024,
            "format": "uri",
            "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
          },
          "state": {
            "enum": [
              "proposed",
              "asserted",
              "disputed",
              "retracted"
            ]
          },
          "reason": {
            "type": "string",
            "minLength": 1,
            "maxLength": 1024
          },
          "evidence": {
            "type": "array",
            "items": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "ref": {
                  "type": "string",
                  "minLength": 1,
                  "maxLength": 1024,
                  "format": "uri",
                  "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
                },
                "kind": {
                  "enum": [
                    "source-record",
                    "review-decision",
                    "name-match",
                    "email-match",
                    "git-author",
                    "legacy-import"
                  ]
                },
                "description": {
                  "type": "string",
                  "minLength": 1,
                  "maxLength": 1024
                }
              },
              "required": [
                "ref",
                "kind",
                "description"
              ]
            },
            "minItems": 1
          }
        },
        "required": [
          "id",
          "previousDigest",
          "recordedAt",
          "effectiveAt",
          "actor",
          "state",
          "reason",
          "evidence"
        ]
      },
      "minItems": 1
    }
  },
  "required": [
    "format",
    "version",
    "id",
    "dimension",
    "purpose",
    "policyDigest",
    "binding",
    "target",
    "relation",
    "endpointResolution",
    "validFrom",
    "validTo",
    "inferencePermitted",
    "history"
  ],
  "$defs": {
    "policy": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "format": {
          "const": "vercy-identity-reference-policy"
        },
        "version": {
          "const": "0.1.0"
        },
        "id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "dimension": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "purpose": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024
        },
        "subjectPrefix": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-z][a-z0-9+.-]*:.+[:/]$"
        },
        "validFrom": {
          "type": "string",
          "format": "date-time",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
        },
        "validTo": {
          "anyOf": [
            {
              "type": "string",
              "format": "date-time",
              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
            },
            {
              "type": "null"
            }
          ]
        },
        "issuers": {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 1,
            "maxLength": 1024,
            "format": "uri",
            "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
          },
          "minItems": 1,
          "uniqueItems": true
        },
        "relations": {
          "type": "array",
          "items": {
            "enum": [
              "equivalent-in-context",
              "not-same-assertion",
              "probable-entity-match"
            ]
          },
          "minItems": 1,
          "uniqueItems": true
        },
        "actors": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": false,
            "properties": {
              "actor": {
                "type": "string",
                "minLength": 1,
                "maxLength": 1024,
                "format": "uri",
                "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
              },
              "states": {
                "type": "array",
                "items": {
                  "enum": [
                    "proposed",
                    "asserted",
                    "disputed",
                    "retracted"
                  ]
                },
                "minItems": 1,
                "uniqueItems": true
              }
            },
            "required": [
              "actor",
              "states"
            ]
          },
          "minItems": 1
        },
        "readers": {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 1,
            "maxLength": 1024,
            "format": "uri",
            "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
          },
          "minItems": 1,
          "uniqueItems": true
        },
        "schemeKinds": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": false,
            "properties": {
              "scheme": {
                "type": "string",
                "minLength": 1,
                "maxLength": 1024,
                "format": "uri",
                "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
              },
              "schemeVersion": {
                "type": "string",
                "minLength": 1,
                "maxLength": 1024
              },
              "issuer": {
                "type": "string",
                "minLength": 1,
                "maxLength": 1024,
                "format": "uri",
                "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
              },
              "scope": {
                "type": "string",
                "minLength": 1,
                "maxLength": 1024,
                "format": "uri",
                "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
              },
              "kind": {
                "enum": [
                  "person",
                  "organization",
                  "user-account",
                  "service-account"
                ]
              }
            },
            "required": [
              "scheme",
              "schemeVersion",
              "issuer",
              "scope",
              "kind"
            ]
          },
          "minItems": 1
        },
        "subjectNamespaces": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": false,
            "properties": {
              "kind": {
                "enum": [
                  "person",
                  "organization",
                  "user-account",
                  "service-account"
                ]
              },
              "prefix": {
                "type": "string",
                "minLength": 1,
                "maxLength": 1024,
                "format": "uri",
                "pattern": "^[a-z][a-z0-9+.-]*:.+[:/]$"
              }
            },
            "required": [
              "kind",
              "prefix"
            ]
          },
          "minItems": 1
        },
        "dataClasses": {
          "type": "array",
          "items": {
            "enum": [
              "synthetic",
              "restricted"
            ]
          },
          "minItems": 1,
          "uniqueItems": true
        }
      },
      "required": [
        "format",
        "version",
        "id",
        "dimension",
        "purpose",
        "subjectPrefix",
        "validFrom",
        "validTo",
        "issuers",
        "relations",
        "actors",
        "readers",
        "dataClasses",
        "schemeKinds",
        "subjectNamespaces"
      ]
    },
    "query": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "scheme": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "schemeVersion": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024
        },
        "issuer": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "scope": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "value": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024
        }
      },
      "required": [
        "scheme",
        "schemeVersion",
        "issuer",
        "scope",
        "value"
      ]
    },
    "binding": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "assignmentId": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "scheme": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "schemeVersion": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024
        },
        "issuer": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "scope": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "value": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024
        },
        "comparison": {
          "const": "exact-string"
        },
        "kind": {
          "enum": [
            "person",
            "organization",
            "user-account",
            "service-account"
          ]
        },
        "validFrom": {
          "type": "string",
          "format": "date-time",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
        },
        "validTo": {
          "anyOf": [
            {
              "type": "string",
              "format": "date-time",
              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
            },
            {
              "type": "null"
            }
          ]
        },
        "recordedAt": {
          "type": "string",
          "format": "date-time",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
        },
        "sourceRecord": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "sourceReferentRef": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024,
          "format": "uri",
          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
        },
        "personalDataClass": {
          "enum": [
            "synthetic",
            "restricted"
          ]
        },
        "credentialProhibition": {
          "const": true
        }
      },
      "required": [
        "assignmentId",
        "scheme",
        "schemeVersion",
        "issuer",
        "scope",
        "value",
        "comparison",
        "kind",
        "validFrom",
        "validTo",
        "recordedAt",
        "sourceRecord",
        "sourceReferentRef",
        "personalDataClass",
        "credentialProhibition"
      ]
    }
  }
}