{"ref":"artifact:miyasuta-auth-samples","page":"/artifacts/miyasuta-auth-samples","json":"/artifacts/miyasuta-auth-samples.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"miyasuta-auth-samples","name":"auth-samples","artifact_type":"sample","ecosystem":"cap","domain":"security-and-compliance","origin_ring":"independent","use_as":"reference","description":{"one_line":"Two CAP services and a UI over them, set up so role and instance restrictions can be tried out against three mock users instead of a real identity provider.","short":"CAP services and a UI for trying role restrictions with mock users","what_it_solves":"SalesOrderService requires an authenticated user, and its SalesOrders and SalesOrderItems entities each grant READ to Viewer, READ and WRITE to Sales and READ to Admin, with `where: 'company = $user.company'` on the Viewer and Sales grants alone, so those two see only the rows of their own company while Admin reads every one. The Products entity carries the same three grants and no instance restriction. The three users the README sends a reader to sit in `salesorders/.cdsrc.json` under the mock strategy, each with one role and a Company and a Region attribute; `company` is the only attribute any rule reads, and the three users differ in it, so a restriction can be seen to bite by logging in as someone else. The products project is consumed by the salesorders one as an imported OData service, over basic authentication against a fixed user locally and through a products-srv destination in production. What a local run uses is the mock strategy; what a deployment binds is in the project's own mta.yaml, which declares an xsuaa instance with its xs-security.json, a destination instance and an HDI container."},"links":{"repo":"https://github.com/miyasuta/auth-samples"},"compat":{"runtimes":["node"],"deployment":["cf"]},"demonstrates":["capability:authentication","capability:authorization","capability:service-integration"],"requires":[{"ref":"artifact:btp-authorization-and-trust-management","for":"The project declares its uaa binding as kind xsuaa, and the MTA deploys an xsuaa instance from the project's own xs-security.json: outside a local run, that instance is where the roles the restrict rules name live.","requirement":"required","sources":[{"url":"https://raw.githubusercontent.com/miyasuta/auth-samples/master/salesorders/package.json","title":"miyasuta/auth-samples — salesorders/package.json","checked":"2026-10-19","quote":"\"uaa\": {\n        \"kind\": \"xsuaa\"\n      }"},{"url":"https://raw.githubusercontent.com/miyasuta/auth-samples/master/salesorders/mta.yaml","title":"miyasuta/auth-samples — salesorders/mta.yaml","checked":"2026-10-19","quote":"- name: salesorders-uaa\n   type: org.cloudfoundry.managed-service\n   parameters:\n     service: xsuaa\n     service-plan: application\n     path: ./xs-security.json"}]},{"ref":"artifact:btp-destination","for":"In production the imported products service is reached by the name of a destination rather than an address, and the MTA binds a destination instance on the lite plan to the service module.","requirement":"required","sources":[{"url":"https://raw.githubusercontent.com/miyasuta/auth-samples/master/salesorders/package.json","title":"miyasuta/auth-samples — salesorders/package.json","checked":"2026-10-19","quote":"\"destination\": \"products-srv\","},{"url":"https://raw.githubusercontent.com/miyasuta/auth-samples/master/salesorders/mta.yaml","title":"miyasuta/auth-samples — salesorders/mta.yaml","checked":"2026-10-19","quote":"- name: salesorders-dest\n   type: org.cloudfoundry.managed-service\n   parameters:\n     service: destination\n     service-plan: lite"}]}],"maintainers":["actor:mio-yasutake"],"contributors":["actor:mio-yasutake"],"provenance":{"discovered_via":[{"source":"source:github-orgs","channel":"miyasuta"}],"first_seen":"2026-10-08"},"drafted_with_ai":true},"effective_normative_relations":[],"readings":{"liveness":[{"label":"Maintenance","tier":"unknown","evidence":"no release data"},{"label":"Continuity","tier":"fair","evidence":"one contributor, personally owned"},{"label":"Repository","tier":"poor","evidence":"pushed 2021-11, not archived"}],"compatibility":[{"label":"Declared for","tier":"fair","evidence":"nothing declared"},{"label":"Survived majors","tier":"unknown","evidence":"no release dates"},{"label":"Maintainer's CI","tier":"fair","evidence":"no CI configured"}],"practice":[{"label":"Tests","tier":"good","evidence":"8 test files"},{"label":"Docs","tier":"poor","evidence":"README <1 KB"},{"label":"Changelog","tier":"fair","evidence":"none in the repo"}],"reach":[{"value":null,"unit":"installs/week"},{"value":0,"unit":"watching"}]},"signals":{"crawled_at":"2026-10-25","npm":"not published under this name","stars":0,"forks":0,"open_issues":0,"archived":false,"pushed_at":"2021-11-11","license_spdx":null,"org_owned":false,"default_branch":"master","created_at":"2021-10-12T21:43:36Z","open_prs":0,"tree_truncated":false,"test_files":8,"workflows":0,"other_ci":false,"readme_bytes":416,"docs_files":0,"changelog":false,"license_file":false,"dts_files":0,"first_commit":"2021-10-12","last_commit":"2021-11-11","commits":11,"contributors":1,"readme_path":"README.md","readme_sha":"50f3c02433317d9b7e95644f439e0a8151cffc30","repo_read":"2026-10-25"},"edges":{"maintainers":[{"ref":"actor:mio-yasutake","name":"Mio Yasutake","json":"/actors/mio-yasutake.json"}],"contributors":[{"ref":"actor:mio-yasutake","name":"Mio Yasutake","json":"/actors/mio-yasutake.json"}],"explained_by":[],"alternative_to_this":[],"needed_by":[],"available_via":[],"parts":[],"add_ons":[],"answered_through_parts":[]}}