docs(annex): add normative Operation-to-RIGHT mapping#586
Open
aorzelskiGH wants to merge 1 commit into
Open
Conversation
Add a new annex that defines, for every AAS HTTP/REST API operation, the RIGHT (per IDTA-01004 rightsEnum) an access-rule enforcement point MUST use. The table covers: - AAS Repository and AAS Service operations (shells, submodels, submodel elements, attachments, operation invocation), - Concept Description Repository operations, - Registry operations (shell- and submodel-descriptors), - Discovery operations (/lookup/shells), - /description and /query. For PUT on client-addressable resources, the required RIGHT is listed as "CREATE or UPDATE" and the enforcement point resolves the right at request time based on existence. Also register the new annex in nav.adoc. Refs: Review Finding T-10 Made-with: Cursor
aorzelskiGH
requested review from
BirgitBoss,
alexgordtop,
danielporta,
g1zzm0,
mjacoby,
sebbader-sap,
waltersve and
zrgt
as code owners
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
QDJVMC found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
BirgitBoss
reviewed
May 11, 2026
| | DeleteSubmodelById | DELETE | /submodels/{submodelIdentifier} | DELETE | "/submodels/*" | ||
|
|
||
| | GetAllSubmodelElements | GET | /submodels/{submodelIdentifier}/submodel-elements | READ | "/submodels/*/submodel-elements" | ||
| | GetSubmodelElementByPath | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | READ | "/submodels/*/submodel-elements/*" |
Collaborator
There was a problem hiding this comment.
the two "*" are not displayed in html
Suggested change
| | GetSubmodelElementByPath | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | READ | "/submodels/*/submodel-elements/*" | |
| | GetSubmodelElementByPath | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | READ | "/submodels/\*/submodel-elements/*" |
Collaborator
There was a problem hiding this comment.
better in general to use code formatting and not text
BirgitBoss
reviewed
May 11, 2026
| | GetAllSubmodelElements | GET | /submodels/{submodelIdentifier}/submodel-elements | READ | "/submodels/*/submodel-elements" | ||
| | GetSubmodelElementByPath | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | READ | "/submodels/*/submodel-elements/*" | ||
| | PostSubmodelElementByPath | POST | /submodels/{submodelIdentifier}/submodel-elements | CREATE | "/submodels/*/submodel-elements" | ||
| | PutSubmodelElementByPath | PUT | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | CREATE or UPDATE | "/submodels/*/submodel-elements/*" |
Collaborator
There was a problem hiding this comment.
Suggested change
| | PutSubmodelElementByPath | PUT | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | CREATE or UPDATE | "/submodels/*/submodel-elements/*" | |
| | PutSubmodelElementByPath | PUT | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | CREATE or UPDATE | "/submodels/\*/submodel-elements/*" |
BirgitBoss
reviewed
May 11, 2026
| | GetSubmodelElementByPath | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | READ | "/submodels/*/submodel-elements/*" | ||
| | PostSubmodelElementByPath | POST | /submodels/{submodelIdentifier}/submodel-elements | CREATE | "/submodels/*/submodel-elements" | ||
| | PutSubmodelElementByPath | PUT | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | CREATE or UPDATE | "/submodels/*/submodel-elements/*" | ||
| | PatchSubmodelElementByPath | PATCH | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | UPDATE | "/submodels/*/submodel-elements/*" |
Collaborator
There was a problem hiding this comment.
Suggested change
| | PatchSubmodelElementByPath | PATCH | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | UPDATE | "/submodels/*/submodel-elements/*" | |
| | PatchSubmodelElementByPath | PATCH | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | UPDATE | "/submodels/\*/submodel-elements/*" |
BirgitBoss
reviewed
May 11, 2026
| | PostSubmodelElementByPath | POST | /submodels/{submodelIdentifier}/submodel-elements | CREATE | "/submodels/*/submodel-elements" | ||
| | PutSubmodelElementByPath | PUT | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | CREATE or UPDATE | "/submodels/*/submodel-elements/*" | ||
| | PatchSubmodelElementByPath | PATCH | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | UPDATE | "/submodels/*/submodel-elements/*" | ||
| | DeleteSubmodelElementByPath | DELETE | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | DELETE | "/submodels/*/submodel-elements/*" |
Collaborator
There was a problem hiding this comment.
Suggested change
| | DeleteSubmodelElementByPath | DELETE | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | DELETE | "/submodels/*/submodel-elements/*" | |
| | DeleteSubmodelElementByPath | DELETE | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | DELETE | "/submodels/\*/submodel-elements/*" |
BirgitBoss
reviewed
May 11, 2026
| | PutSubmodelElementByPath | PUT | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | CREATE or UPDATE | "/submodels/*/submodel-elements/*" | ||
| | PatchSubmodelElementByPath | PATCH | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | UPDATE | "/submodels/*/submodel-elements/*" | ||
| | DeleteSubmodelElementByPath | DELETE | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | DELETE | "/submodels/*/submodel-elements/*" | ||
| | InvokeOperation | POST | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/invoke | EXECUTE | "/submodels/*/submodel-elements/*/invoke" |
Collaborator
There was a problem hiding this comment.
Suggested change
| | InvokeOperation | POST | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/invoke | EXECUTE | "/submodels/*/submodel-elements/*/invoke" | |
| | InvokeOperation | POST | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/invoke | EXECUTE | "/submodels/\*/submodel-elements/*/invoke" |
BirgitBoss
reviewed
May 11, 2026
| | PatchSubmodelElementByPath | PATCH | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | UPDATE | "/submodels/*/submodel-elements/*" | ||
| | DeleteSubmodelElementByPath | DELETE | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | DELETE | "/submodels/*/submodel-elements/*" | ||
| | InvokeOperation | POST | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/invoke | EXECUTE | "/submodels/*/submodel-elements/*/invoke" | ||
| | InvokeOperationAsync | POST | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/invoke-async | EXECUTE | "/submodels/*/submodel-elements/*/invoke-async" |
Collaborator
There was a problem hiding this comment.
Suggested change
| | InvokeOperationAsync | POST | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/invoke-async | EXECUTE | "/submodels/*/submodel-elements/*/invoke-async" | |
| | InvokeOperationAsync | POST | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/invoke-async | EXECUTE | "/submodels/\*/submodel-elements/*/invoke-async" |
BirgitBoss
reviewed
May 11, 2026
| | DeleteSubmodelElementByPath | DELETE | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath} | DELETE | "/submodels/*/submodel-elements/*" | ||
| | InvokeOperation | POST | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/invoke | EXECUTE | "/submodels/*/submodel-elements/*/invoke" | ||
| | InvokeOperationAsync | POST | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/invoke-async | EXECUTE | "/submodels/*/submodel-elements/*/invoke-async" | ||
| | GetOperationAsyncStatus | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/operation-status/{handleId} | READ | "/submodels/*/submodel-elements/*/operation-status/*" |
Collaborator
There was a problem hiding this comment.
Suggested change
| | GetOperationAsyncStatus | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/operation-status/{handleId} | READ | "/submodels/*/submodel-elements/*/operation-status/*" | |
| | GetOperationAsyncStatus | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/operation-status/{handleId} | READ | "/submodels/\*/submodel-elements/*/operation-status/*" |
BirgitBoss
reviewed
May 11, 2026
| | InvokeOperation | POST | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/invoke | EXECUTE | "/submodels/*/submodel-elements/*/invoke" | ||
| | InvokeOperationAsync | POST | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/invoke-async | EXECUTE | "/submodels/*/submodel-elements/*/invoke-async" | ||
| | GetOperationAsyncStatus | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/operation-status/{handleId} | READ | "/submodels/*/submodel-elements/*/operation-status/*" | ||
| | GetFileByPath | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/attachment | READ | "/submodels/*/submodel-elements/*/attachment" |
Collaborator
There was a problem hiding this comment.
Suggested change
| | GetFileByPath | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/attachment | READ | "/submodels/*/submodel-elements/*/attachment" | |
| | GetFileByPath | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/attachment | READ | "/submodels/\*/submodel-elements/*/attachment" |
BirgitBoss
reviewed
May 11, 2026
| | InvokeOperationAsync | POST | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/invoke-async | EXECUTE | "/submodels/*/submodel-elements/*/invoke-async" | ||
| | GetOperationAsyncStatus | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/operation-status/{handleId} | READ | "/submodels/*/submodel-elements/*/operation-status/*" | ||
| | GetFileByPath | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/attachment | READ | "/submodels/*/submodel-elements/*/attachment" | ||
| | PutFileByPath | PUT | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/attachment | UPDATE | "/submodels/*/submodel-elements/*/attachment" |
Collaborator
There was a problem hiding this comment.
Suggested change
| | PutFileByPath | PUT | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/attachment | UPDATE | "/submodels/*/submodel-elements/*/attachment" | |
| | PutFileByPath | PUT | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/attachment | UPDATE | "/submodels/\*/submodel-elements/*/attachment" |
BirgitBoss
reviewed
May 11, 2026
| | GetOperationAsyncStatus | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/operation-status/{handleId} | READ | "/submodels/*/submodel-elements/*/operation-status/*" | ||
| | GetFileByPath | GET | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/attachment | READ | "/submodels/*/submodel-elements/*/attachment" | ||
| | PutFileByPath | PUT | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/attachment | UPDATE | "/submodels/*/submodel-elements/*/attachment" | ||
| | DeleteFileByPath | DELETE | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/attachment | DELETE | "/submodels/*/submodel-elements/*/attachment" |
Collaborator
There was a problem hiding this comment.
Suggested change
| | DeleteFileByPath | DELETE | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/attachment | DELETE | "/submodels/*/submodel-elements/*/attachment" | |
| | DeleteFileByPath | DELETE | /submodels/{submodelIdentifier}/submodel-elements/{idShortPath}/attachment | DELETE | "/submodels/\*/submodel-elements/*/attachment" |
BirgitBoss
requested changes
May 11, 2026
Collaborator
BirgitBoss
left a comment
BirgitBoss
left a comment
There was a problem hiding this comment.
approve but check for correct html representation of the examples with severl "*" in the path
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a normative annex "Operation to RIGHT Mapping" that binds every AAS HTTP/REST API operation to a RIGHT value from IDTA-01004's
rightsEnum, together with a compatible ROUTE literal example.Problem
IDTA-01004 provides an indicative mapping from RIGHTS to HTTP methods, but the per-operation mapping (operationId -> RIGHT) is not defined in either spec. Enforcement points therefore make inconsistent choices, in particular for:
Solution
Add
pages/annex/operation-to-right-mapping.adocwith a normative table covering Shell, Submodel, SubmodelElement, attachment, ConceptDescription, Descriptor (AAS / Submodel Registry), Discovery, Description and Query operations. Register the annex innav.adoc.Affected files
documentation/IDTA-01002-3/modules/ROOT/pages/annex/operation-to-right-mapping.adoc(new)documentation/IDTA-01002-3/modules/ROOT/nav.adocReview notes
admin-shell-io/aas-specs-security#...references this annex from the Rights-and-operation-verbs section.Refs: Review Finding T-10