zalando / restful-api-guidelines

A model set of guidelines for RESTful APIs and Events, created by Zalando
https://opensource.zalando.com/restful-api-guidelines/
Creative Commons Attribution 4.0 International
2.61k stars 384 forks source link

Rule 225: Include exception for Partner-IAM #767

Closed ePaul closed 10 months ago

ePaul commented 1 year ago

Our Partner IAM system (which is used by APIs for Zalando's partner-facing UIs) has scope naming rules which don't fit to the naming convention in rule 225 (it uses / instead of .).

This causes violations when checking APIs which declare such scopes in our linter.

We should add an exception to the rule, maybe in this form:

This naming convention applies to Zalando IAM's scopes in service-to-service tokens. For IAM systems with other naming rules (e.g. Zalando Partner IAM), the naming convention is to be applied analogously.

We can then add a configuration to Zally for excluding scopes for specific IAM systems from the checking of this rule (or potentially add an alternative regexp).