{ "$defs": { "auditRecord": { "additionalProperties": false, "properties": { "actorId": { "$ref": "#/$defs/uuid" }, "after": { "pattern": "^sha256:[0-9a-f]{64}$", "type": "string" }, "before": { "pattern": "^sha256:[0-9a-f]{64}$", "type": "string" }, "eventId": { "pattern": "^audit:[a-z0-9:-]+$", "type": "string" }, "idempotencyKey": { "type": [ "string", "null" ], "maxLength": 128 }, "occurredAt": { "$ref": "#/$defs/instant" }, "reason": { "type": "string", "minLength": 1 }, "targetId": { "minLength": 1, "type": "string" }, "immutable": { "const": true } }, "required": [ "eventId", "actorId", "targetId", "occurredAt", "reason", "idempotencyKey", "before", "after", "immutable" ], "type": "object" }, "concurrency": { "additionalProperties": false, "properties": { "barrier": { "pattern": "^[a-z][a-z0-9_]{2,63}$", "type": "string" }, "events": { "items": { "pattern": "^event_[a-z0-9_]+$", "type": "string" }, "type": "array", "uniqueItems": true } }, "required": [ "barrier", "events" ], "type": "object" }, "effects": { "additionalProperties": false, "properties": { "auditEvents": { "minimum": 0, "type": "integer" }, "authMutations": { "minimum": 0, "type": "integer" }, "businessMutations": { "minimum": 0, "type": "integer" }, "signerCalls": { "minimum": 0, "type": "integer" } }, "required": [ "businessMutations", "authMutations", "signerCalls", "auditEvents" ], "type": "object" }, "envelope": { "additionalProperties": false, "oneOf": [ { "not": { "required": [ "error" ] }, "required": [ "data" ] }, { "not": { "required": [ "data" ] }, "required": [ "error" ] } ], "properties": { "data": { "type": "object" }, "error": { "additionalProperties": false, "properties": { "code": { "enum": [ "INVALID_REQUEST", "INVALID_CREDENTIALS", "AUTH_REQUIRED", "CSRF_REJECTED", "FORBIDDEN", "NOT_FOUND", "STATE_CONFLICT", "IDEMPOTENCY_CONFLICT", "INSUFFICIENT_CREDITS", "DEFICIT_BLOCKED", "ARTIFACT_EXPIRED", "UPLOAD_REJECTED", "JURISDICTION_BLOCKED", "PACKAGE_REJECTED", "RATE_LIMITED", "DEPENDENCY_UNAVAILABLE", "CAPACITY_UNAVAILABLE" ] }, "field_errors": { "additionalProperties": { "maxLength": 128, "minLength": 1, "type": "string" }, "propertyNames": { "enum": [ "email", "password", "terms_version", "privacy_version", "token", "new_password", "refresh_csrf_generation", "upload_id" ] }, "type": "object" }, "message": { "maxLength": 128, "minLength": 1, "type": "string" }, "retryable": { "type": "boolean" } }, "required": [ "code", "message", "retryable", "field_errors" ], "type": "object" }, "request_id": { "$ref": "#/$defs/uuid" }, "version": { "const": "2026-08-23" } }, "required": [ "version", "request_id" ], "type": "object" }, "eventResult": { "additionalProperties": false, "properties": { "errorCode": { "type": [ "string", "null" ] }, "eventId": { "pattern": "^event_[a-z0-9_]+$", "type": "string" }, "mutationCommitted": { "type": "boolean" }, "resultRef": { "minLength": 1, "type": "string" }, "status": { "maximum": 599, "minimum": 200, "type": "integer" } }, "required": [ "eventId", "status", "errorCode", "mutationCommitted", "resultRef" ], "type": "object" }, "expected": { "additionalProperties": false, "allOf": [ { "if": { "properties": { "outcome": { "const": "allow" } }, "required": [ "outcome" ] }, "then": { "properties": { "envelope": { "not": { "required": [ "error" ] }, "required": [ "data" ] }, "status": { "maximum": 299, "minimum": 200 } } } }, { "if": { "properties": { "outcome": { "const": "deny" } }, "required": [ "outcome" ] }, "then": { "properties": { "envelope": { "not": { "required": [ "data" ] }, "required": [ "error" ] }, "status": { "maximum": 499, "minimum": 400 } } } }, { "if": { "properties": { "outcome": { "const": "blocked" } }, "required": [ "outcome" ] }, "then": { "properties": { "envelope": { "properties": { "error": { "properties": { "code": { "const": "DEPENDENCY_UNAVAILABLE" } } } }, "required": [ "error" ] }, "status": { "const": 503 } } } } ], "properties": { "auditRecords": { "items": { "$ref": "#/$defs/auditRecord" }, "maxItems": 1, "type": "array" }, "blockedReason": { "type": [ "string", "null" ] }, "effects": { "$ref": "#/$defs/effects" }, "envelope": { "$ref": "#/$defs/envelope" }, "eventResults": { "items": { "$ref": "#/$defs/eventResult" }, "type": "array" }, "headers": { "additionalProperties": { "type": "string" }, "type": "object" }, "outcome": { "enum": [ "allow", "deny", "blocked" ] }, "rateAssertion": { "oneOf": [ { "type": "null" }, { "type": "object", "additionalProperties": false, "required": [ "operation", "identity", "key", "windowStart", "windowSeconds", "limit", "count", "decision" ], "properties": { "operation": { "type": "string" }, "identity": { "type": "string" }, "key": { "type": "string" }, "windowStart": { "$ref": "#/$defs/instant" }, "windowSeconds": { "type": "integer", "minimum": 1 }, "limit": { "type": "integer", "minimum": 1 }, "count": { "type": "integer", "minimum": 0 }, "decision": { "enum": [ "allow", "reject" ] } } } ] }, "sinkAssertions": { "items": { "$ref": "#/$defs/sinkAssertion" }, "type": "array" }, "stateDigestAfter": { "pattern": "^sha256:[0-9a-f]{64}$", "type": "string" }, "stateDigestBefore": { "pattern": "^sha256:[0-9a-f]{64}$", "type": "string" }, "status": { "maximum": 599, "minimum": 200, "type": "integer" }, "transitions": { "items": { "$ref": "#/$defs/transition" }, "type": "array" } }, "required": [ "outcome", "status", "envelope", "headers", "effects", "transitions", "eventResults", "blockedReason", "sinkAssertions", "stateDigestBefore", "stateDigestAfter", "auditRecords", "rateAssertion", "rateAssertion" ], "type": "object" }, "instant": { "format": "date-time", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\\.[0-9]{3}Z$", "type": "string" }, "oracle": { "additionalProperties": false, "properties": { "parser": { "additionalProperties": false, "properties": { "principal": { "type": [ "string", "null" ] }, "source": { "enum": [ "bearer", "cookie", "none" ] }, "state": { "enum": [ "valid", "invalid", "malformed", "absent", "expired", "revoked" ] } }, "required": [ "source", "state", "principal" ], "type": "object" }, "preflight": { "additionalProperties": false, "properties": { "category": { "enum": [ "exact_success", "reject_origin", "reject_acr_missing", "reject_method", "reject_header" ] }, "matrixKey": { "pattern": "^sha256:[0-9a-f]{64}$", "type": "string" }, "origin": { "type": [ "string", "null" ] }, "requestedHeaders": { "type": [ "string", "null" ] }, "requestedMethod": { "type": [ "string", "null" ] }, "route": { "type": "string" } }, "required": [ "route", "origin", "requestedMethod", "requestedHeaders", "matrixKey", "category" ], "type": [ "object", "null" ] }, "rate": { "additionalProperties": false, "properties": { "exactLimit": { "const": 10 }, "key": { "type": "string" }, "operation": { "type": "string" }, "policyId": { "type": [ "string", "null" ] }, "windowSeconds": { "const": 60 } }, "required": [ "operation", "policyId", "windowSeconds", "exactLimit", "key" ], "type": [ "object", "null" ] }, "requestBindingSha256": { "pattern": "^sha256:[0-9a-f]{64}$", "type": "string" }, "responseBindingSha256": { "pattern": "^sha256:[0-9a-f]{64}$", "type": "string" }, "targets": { "items": { "additionalProperties": false, "properties": { "id": { "$ref": "#/$defs/uuid" }, "ownerId": { "$ref": "#/$defs/uuid" }, "registryKey": { "type": "string" } }, "required": [ "registryKey", "id", "ownerId" ], "type": "object" }, "type": "array" } }, "required": [ "requestBindingSha256", "responseBindingSha256", "parser", "targets", "preflight", "rate" ], "type": "object" }, "precondition": { "additionalProperties": false, "properties": { "kind": { "enum": [ "session", "object", "idempotency", "rate", "dependency", "csrf", "refresh_family" ] }, "ref": { "minLength": 1, "type": "string" }, "state": { "minLength": 1, "type": "string" } }, "required": [ "kind", "ref", "state" ], "type": "object" }, "rateAssertion": { "oneOf": [ { "type": "null" }, { "additionalProperties": false, "properties": { "count": { "minimum": 1, "type": "integer" }, "decision": { "enum": [ "allow", "reject" ] }, "identity": { "minLength": 1, "type": "string" }, "key": { "pattern": "^rate:[a-z_]+:(ip|principal):.+$", "type": "string" }, "limit": { "minimum": 1, "type": "integer" }, "operation": { "enum": [ "registration", "login", "upload_creation", "upload_completion", "conversion_acceptance", "checkout", "download_signing", "stripe_webhook", "worker_claim", "worker_heartbeat", "worker_completion", "admin_mutation" ] }, "windowSeconds": { "minimum": 1, "type": "integer" }, "windowStart": { "$ref": "#/$defs/instant" } }, "required": [ "operation", "identity", "key", "windowStart", "windowSeconds", "limit", "count", "decision" ], "type": "object" } ] }, "request": { "additionalProperties": false, "allOf": [ { "not": { "properties": { "body": { "not": { "type": "null" } }, "rawBody": { "not": { "type": "null" } } }, "required": [ "body", "rawBody" ] } }, { "if": { "properties": { "operation": { "const": "session" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "GET" }, "path": { "const": "/v1/auth/session" } } } }, { "if": { "properties": { "operation": { "const": "logout" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/auth/logout" } } } }, { "if": { "properties": { "operation": { "const": "refresh" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/auth/refresh" } } } }, { "if": { "properties": { "operation": { "const": "refresh_csrf" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/auth/refresh-csrf" } } } }, { "if": { "properties": { "operation": { "const": "conversion_accept" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/conversions" } } } }, { "if": { "properties": { "operation": { "const": "csrf_issue" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/auth/csrf" } } } }, { "if": { "properties": { "operation": { "const": "registration" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/rate-fixture/registration" } } } }, { "if": { "properties": { "operation": { "const": "upload_creation" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/rate-fixture/upload_creation" } } } }, { "if": { "properties": { "operation": { "const": "upload_completion" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/rate-fixture/upload_completion" } } } }, { "if": { "properties": { "operation": { "const": "conversion_acceptance" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/rate-fixture/conversion_acceptance" } } } }, { "if": { "properties": { "operation": { "const": "checkout" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/rate-fixture/checkout" } } } }, { "if": { "properties": { "operation": { "const": "download_signing" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/rate-fixture/download_signing" } } } }, { "if": { "properties": { "operation": { "const": "stripe_webhook" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/rate-fixture/stripe_webhook" } } } }, { "if": { "properties": { "operation": { "const": "worker_claim" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/rate-fixture/worker_claim" } } } }, { "if": { "properties": { "operation": { "const": "worker_heartbeat" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/rate-fixture/worker_heartbeat" } } } }, { "if": { "properties": { "operation": { "const": "worker_completion" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/rate-fixture/worker_completion" } } } }, { "if": { "properties": { "operation": { "const": "admin_mutation" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/rate-fixture/admin_mutation" } } } }, { "if": { "properties": { "operation": { "const": "readiness" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "GET" }, "path": { "const": "/ready" } } } }, { "if": { "properties": { "operation": { "const": "admin_retry" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/admin/retry" } } } }, { "if": { "properties": { "operation": { "const": "admin_adjust" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/admin/adjust" } } } }, { "if": { "properties": { "operation": { "const": "admin_suspend" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/admin/suspend" } } } }, { "if": { "properties": { "operation": { "const": "register" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/auth/register" } } } }, { "if": { "properties": { "operation": { "const": "password_reset_request" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/auth/password-reset/request" } } } }, { "if": { "properties": { "operation": { "const": "password_reset_complete" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/auth/password-reset/complete" } } } }, { "if": { "properties": { "operation": { "const": "auth_state_machine" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/auth/refresh" } } } }, { "if": { "properties": { "operation": { "const": "crash_injection" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "POST" }, "path": { "const": "/v1/auth/refresh" } } } }, { "if": { "properties": { "operation": { "const": "purchase_read" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "GET" }, "path": { "const": "/v1/purchases/55555555-5555-4555-8555-555555555551" } } } }, { "if": { "properties": { "operation": { "const": "account_read" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "GET" }, "path": { "const": "/v1/account" } } } }, { "if": { "properties": { "operation": { "const": "zip_download" } }, "required": [ "operation" ] }, "then": { "properties": { "method": { "const": "GET" }, "path": { "const": "/v1/conversions/33333333-3333-4333-8333-333333333331/zip" } } } } ], "properties": { "authContext": { "additionalProperties": false, "properties": { "mode": { "enum": [ "none", "cookie", "bearer" ] }, "parserState": { "enum": [ "absent", "malformed", "invalid", "valid", "expired", "revoked" ] }, "principal": { "enum": [ null, "userA", "userB", "admin", "expired", "disabled" ], "type": [ "string", "null" ] } }, "required": [ "mode", "parserState", "principal" ], "type": "object" }, "body": { "type": [ "object", "array", "string", "null" ] }, "client": { "additionalProperties": false, "properties": { "forwardedFor": { "items": { "type": "string" }, "maxItems": 8, "type": "array" }, "peerIp": { "format": "ipv4", "type": "string" }, "trustedProxy": { "type": "boolean" } }, "required": [ "peerIp", "forwardedFor", "trustedProxy" ], "type": "object" }, "contentType": { "maxLength": 128, "type": [ "string", "null" ] }, "cookies": { "additionalProperties": { "maxLength": 256, "minLength": 1, "type": "string" }, "propertyNames": { "enum": [ "__Host-pdf2html_access", "__Host-pdf2html_csrf", "__Secure-pdf2html_refresh", "__Secure-pdf2html_refresh_csrf" ] }, "type": "object" }, "headers": { "additionalProperties": { "maxLength": 1024, "type": "string" }, "propertyNames": { "enum": [ "Accept", "Authorization", "Content-Type", "Idempotency-Key", "Origin", "X-API-Version", "X-CSRF-Token", "X-Refresh-CSRF-Token", "Stripe-Signature", "Access-Control-Request-Method", "Access-Control-Request-Headers", "X-Forwarded-For", "Forwarded", "X-Header-Marker" ] }, "type": "object" }, "method": { "enum": [ "GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS" ] }, "operation": { "enum": [ "account_read", "admin_adjust", "admin_mutation", "admin_retry", "admin_suspend", "auth_state_machine", "checkout", "conversion_accept", "conversion_acceptance", "conversion_cancel", "conversion_list", "conversion_read", "crash_injection", "csrf_issue", "download_sign", "download_signing", "login", "logout", "password_reset_complete", "password_reset_request", "preflight", "purchase_read", "readiness", "refresh", "refresh_csrf", "register", "registration", "session", "sink_scan", "source_metadata", "stripe_webhook", "upload_complete", "upload_completion", "upload_creation", "upload_read", "worker_claim", "worker_completion", "worker_heartbeat", "zip_download" ] }, "path": { "maxLength": 512, "pattern": "^/v1/|^/ready$", "type": "string" }, "rawBody": { "maxLength": 4096, "type": [ "string", "null" ] } }, "required": [ "operation", "method", "path", "headers", "cookies", "contentType", "body", "rawBody", "client", "authContext" ], "type": "object" }, "sinkAssertion": { "additionalProperties": false, "properties": { "forbiddenCanaryRefs": { "items": { "enum": [ "filename", "pdf_text", "generated_html", "object_key", "auth_secret", "csrf_token", "signed_url", "webhook_signature", "converter_stderr" ] }, "minItems": 1, "type": "array", "uniqueItems": true }, "requiredMarkers": { "items": { "const": "[REDACTED:REFRESH_CSRF]" }, "type": "array", "uniqueItems": true }, "sink": { "enum": [ "app_log", "proxy_log", "waf_log", "cdn_log", "apm", "trace", "metric", "crash_dump", "error_reporter", "support_ui" ] } }, "required": [ "sink", "forbiddenCanaryRefs", "requiredMarkers" ], "type": "object" }, "transition": { "additionalProperties": false, "properties": { "entityId": { "minLength": 1, "type": "string" }, "entityType": { "enum": [ "upload", "conversion", "admin_target", "session", "business" ] }, "event": { "minLength": 1, "type": "string" }, "from": { "minLength": 1, "type": "string" }, "ordinal": { "minimum": 1, "type": "integer" }, "to": { "minLength": 1, "type": "string" } }, "required": [ "entityType", "entityId", "from", "event", "to", "ordinal" ], "type": "object" }, "uuid": { "format": "uuid", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$", "type": "string" } }, "$id": "https://pdf2html.invalid/quality/fixtures/authz-web/case.schema.json", "$schema": "https://json-schema.org/draft/2020-12/schema", "additionalProperties": false, "properties": { "actor": { "enum": [ "none", "userA", "userB", "admin", "expired", "disabled" ] }, "category": { "enum": [ "authentication", "ownership", "cors", "csrf", "cookie", "rate_limit", "idempotency", "admin", "safe_error", "logging", "malformed" ] }, "concurrency": { "oneOf": [ { "type": "null" }, { "$ref": "#/$defs/concurrency" } ] }, "contractRefs": { "items": { "pattern": "^(HTTP|API|SEC|ACT|PRV|SO)-[0-9A-Z-]+$", "type": "string" }, "minItems": 1, "type": "array", "uniqueItems": true }, "description": { "minLength": 1, "type": "string" }, "expected": { "$ref": "#/$defs/expected" }, "fixtureClock": { "$ref": "#/$defs/instant" }, "id": { "pattern": "^AW-[0-9]{3}$", "type": "string" }, "oracle": { "$ref": "#/$defs/oracle" }, "preconditions": { "items": { "$ref": "#/$defs/precondition" }, "type": "array", "uniqueItems": true }, "request": { "$ref": "#/$defs/request" } }, "required": [ "id", "category", "description", "fixtureClock", "actor", "request", "preconditions", "concurrency", "expected", "contractRefs", "oracle" ], "type": "object" }