bootstrap.schema.json

{
  "$defs": {
    "DemoCourse": {
      "additionalProperties": false,
      "description": "The Open edX demo course, imported into the CMS modulestore.\n\nRe-importing overwrites the course in place.",
      "properties": {
        "repo": {
          "default": "https://github.com/openedx/openedx-demo-course",
          "title": "Repo",
          "type": "string"
        },
        "branch": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Branch to import. Omitted, the first of release/<line>, open-release/<line>.master and <line> that exists, where <line> is the platform's own RELEASE_LINE (e.g. verawood, master).",
          "title": "Branch"
        }
      },
      "title": "DemoCourse",
      "type": "object"
    },
    "Migration": {
      "additionalProperties": false,
      "description": "One ``manage.py <service> migrate`` run.\n\nEach runs in a subprocess with that service's settings, since the runner\nitself is set up for one settings module and the CMS migrates under its\nown.",
      "properties": {
        "service": {
          "enum": [
            "lms",
            "cms"
          ],
          "title": "Service",
          "type": "string"
        },
        "app_label": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Migrate only this app. Omitted, migrates all.",
          "title": "App Label"
        },
        "database": {
          "default": "default",
          "description": "The DATABASES alias to migrate. migrate never touches another alias on its own, so an app routed to a separate database (e.g. coursewarehistoryextended on student_module_history) needs its own entry.",
          "title": "Database",
          "type": "string"
        },
        "fake": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Full name of one app_label migration (e.g. 0006_mariadb_uuid_conversion) to record as applied without running it, after applying the migrations it depends on. For a migration that cannot run as written; once it is recorded the entry does nothing.",
          "title": "Fake"
        }
      },
      "required": [
        "service"
      ],
      "title": "Migration",
      "type": "object"
    },
    "OAuthApplication": {
      "additionalProperties": false,
      "description": "A django-oauth-toolkit Application and its oauth_dispatch access record.\n\nMatched on ``client_id``, so an application created by hand in a deployed\nenvironment is adopted (and brought in line with the spec) rather than\nduplicated.\n\n``name`` and each redirect URI may reference Django settings as\n``{SETTING}``, e.g. ``{CMS_ROOT_URL}/complete/edx-oauth2/``, so one spec\nserves every environment whose settings differ.",
      "properties": {
        "name": {
          "title": "Name",
          "type": "string"
        },
        "user": {
          "description": "Username of the owning user; must exist.",
          "title": "User",
          "type": "string"
        },
        "grant_type": {
          "enum": [
            "authorization-code",
            "implicit",
            "password",
            "client-credentials"
          ],
          "title": "Grant Type",
          "type": "string"
        },
        "client_id_env": {
          "title": "Client Id Env",
          "type": "string"
        },
        "client_secret_env": {
          "title": "Client Secret Env",
          "type": "string"
        },
        "redirect_uris": {
          "items": {
            "type": "string"
          },
          "title": "Redirect Uris",
          "type": "array"
        },
        "scopes": {
          "description": "Scopes beyond the defaults the application may request, e.g. user_id for Studio SSO. Empty leaves the access record alone.",
          "items": {
            "type": "string"
          },
          "title": "Scopes",
          "type": "array"
        },
        "skip_authorization": {
          "default": false,
          "title": "Skip Authorization",
          "type": "boolean"
        },
        "public": {
          "default": false,
          "description": "Public client type; confidential otherwise.",
          "title": "Public",
          "type": "boolean"
        }
      },
      "required": [
        "name",
        "user",
        "grant_type",
        "client_id_env",
        "client_secret_env"
      ],
      "title": "OAuthApplication",
      "type": "object"
    },
    "ServiceAccessToken": {
      "additionalProperties": false,
      "description": "A long-lived OAuth2 bearer token for an upstream service integration.\n\nSome integrations do not perform an OAuth2 exchange at all: they are handed\none opaque token and send it as ``Authorization: Bearer`` forever. MITx\nOnline's ``OPENEDX_SERVICE_WORKER_API_TOKEN`` is the example -- it is read\nstraight out of settings and used to enrol learners through the LMS API, so\nwithout a matching ``AccessToken`` row here every enrolment silently fails\nand the upstream records ``edx_enrolled=False``.\n\nSelf-contained on purpose: the entry owns its service account and its\napplication as well as the token, because all three exist only to serve one\nintegration and should appear and disappear together. **Skipped entirely\nwhen ``token_env`` is unset or empty**, so an install with no such\nintegration does not grow an unused staff account.\n\nThe account gets an unusable password: it authenticates only by this token.",
      "properties": {
        "username": {
          "description": "Service account to create and own the token.",
          "title": "Username",
          "type": "string"
        },
        "email": {
          "title": "Email",
          "type": "string"
        },
        "token_env": {
          "description": "Environment variable holding the bearer token. The upstream must be configured with the identical value.",
          "title": "Token Env",
          "type": "string"
        },
        "application_name": {
          "description": "Name for the owning OAuth2 application.",
          "title": "Application Name",
          "type": "string"
        },
        "staff": {
          "default": true,
          "description": "Django is_staff. Enrolling a *different* user through the LMS enrollment API requires it, so a service worker that provisions enrolments needs it set.",
          "title": "Staff",
          "type": "boolean"
        },
        "scopes": {
          "items": {
            "type": "string"
          },
          "title": "Scopes",
          "type": "array"
        },
        "expires_in_days": {
          "default": 3650,
          "description": "Lifetime from apply time. Long by default: this stands in for a credential a deployed environment would hold in a secret store.",
          "title": "Expires In Days",
          "type": "integer"
        }
      },
      "required": [
        "username",
        "email",
        "token_env",
        "application_name"
      ],
      "title": "ServiceAccessToken",
      "type": "object"
    },
    "ThirdPartyAuthProvider": {
      "additionalProperties": false,
      "description": "An ``OAuth2ProviderConfig``: an external IdP the LMS federates login to.\n\n``THIRD_PARTY_AUTH_BACKENDS`` makes a backend *importable*; this row is what\nmakes it *usable*. Without one, ``/auth/login/<backend>/`` 404s even though\nthe backend class is installed and in ``AUTHENTICATION_BACKENDS``.\n\nThe provider's endpoint URLs cannot come from Django settings:\n``OAuth2ProviderConfig.get_setting`` serves ``KEY`` and ``SECRET`` from this\nrow and every other name out of its ``other_settings`` JSON, so that JSON is\nthe only channel for ``AUTHORIZATION_URL`` / ``ACCESS_TOKEN_URL`` /\n``API_ROOT`` / ``DISCOVERY_URL``.\n\nWhich IdP to federate to is a property of the surrounding deployment, not of\nthis stack, so the JSON arrives by environment variable like the credentials\ndo. **An entry whose referenced variables are unset or empty is skipped**,\nwhich is how a standalone install -- one with no upstream IdP in front of it\n-- declines the whole step without needing a different spec file.",
      "properties": {
        "backend_name": {
          "description": "social-core backend name, e.g. ol-oauth2. Must appear in THIRD_PARTY_AUTH_BACKENDS or the provider is never registered.",
          "title": "Backend Name",
          "type": "string"
        },
        "slug": {
          "title": "Slug",
          "type": "string"
        },
        "name": {
          "description": "Label shown on the LMS login page.",
          "title": "Name",
          "type": "string"
        },
        "client_id_env": {
          "title": "Client Id Env",
          "type": "string"
        },
        "client_secret_env": {
          "title": "Client Secret Env",
          "type": "string"
        },
        "other_settings_env": {
          "description": "Environment variable holding the other_settings JSON object. The endpoint URLs live here because Django settings cannot reach them.",
          "title": "Other Settings Env",
          "type": "string"
        },
        "enabled": {
          "default": true,
          "title": "Enabled",
          "type": "boolean"
        },
        "visible": {
          "default": true,
          "title": "Visible",
          "type": "boolean"
        },
        "skip_hinted_login_dialog": {
          "default": true,
          "title": "Skip Hinted Login Dialog",
          "type": "boolean"
        },
        "skip_registration_form": {
          "default": true,
          "description": "Provision the account straight from the IdP's user data instead of prompting. Required when the IdP, not the LMS, owns registration.",
          "title": "Skip Registration Form",
          "type": "boolean"
        },
        "skip_email_verification": {
          "default": true,
          "title": "Skip Email Verification",
          "type": "boolean"
        },
        "sync_learner_profile_data": {
          "default": false,
          "title": "Sync Learner Profile Data",
          "type": "boolean"
        }
      },
      "required": [
        "backend_name",
        "slug",
        "name",
        "client_id_env",
        "client_secret_env",
        "other_settings_env"
      ],
      "title": "ThirdPartyAuthProvider",
      "type": "object"
    },
    "User": {
      "additionalProperties": false,
      "description": "A user the install needs, e.g. a local-dev superuser or a service user.\n\nApplied as declared, including on an existing account: one the spec does\nnot mark ``superuser`` or ``staff`` loses those flags, and every declared\nuser is made active.",
      "properties": {
        "username": {
          "title": "Username",
          "type": "string"
        },
        "email": {
          "title": "Email",
          "type": "string"
        },
        "password_env": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Environment variable holding the password. Omitted, the password is left alone (a new user gets an unusable one), which suits a service user that only ever authenticates with OAuth2.",
          "title": "Password Env"
        },
        "superuser": {
          "default": false,
          "title": "Superuser",
          "type": "boolean"
        },
        "staff": {
          "default": false,
          "description": "Django is_staff. A superuser is always made staff as well.",
          "title": "Staff",
          "type": "boolean"
        }
      },
      "required": [
        "username",
        "email"
      ],
      "title": "User",
      "type": "object"
    },
    "WaffleFlag": {
      "additionalProperties": false,
      "description": "A waffle flag, applied through django-waffle's ``waffle_flag`` command.\n\nThe command can only switch the per-group settings on, so ``superusers``,\n``staff`` and ``authenticated`` being false means \"leave as is\", not\n\"turn off\". ``everyone`` is the one tri-state: true activates the flag for\nall users, false deactivates it, unset leaves it alone.",
      "properties": {
        "name": {
          "title": "Name",
          "type": "string"
        },
        "everyone": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Everyone"
        },
        "superusers": {
          "default": false,
          "title": "Superusers",
          "type": "boolean"
        },
        "staff": {
          "default": false,
          "title": "Staff",
          "type": "boolean"
        },
        "authenticated": {
          "default": false,
          "title": "Authenticated",
          "type": "boolean"
        },
        "percent": {
          "anyOf": [
            {
              "maximum": 100,
              "minimum": 0,
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Whole percent; waffle_flag's --percent only takes an int.",
          "title": "Percent"
        },
        "rollout": {
          "default": false,
          "title": "Rollout",
          "type": "boolean"
        },
        "testing": {
          "default": false,
          "title": "Testing",
          "type": "boolean"
        },
        "create": {
          "default": true,
          "title": "Create",
          "type": "boolean"
        }
      },
      "required": [
        "name"
      ],
      "title": "WaffleFlag",
      "type": "object"
    }
  },
  "additionalProperties": false,
  "description": "Everything a fresh install needs in its database, by step.",
  "properties": {
    "migrate": {
      "items": {
        "$ref": "#/$defs/Migration"
      },
      "title": "Migrate",
      "type": "array"
    },
    "users": {
      "items": {
        "$ref": "#/$defs/User"
      },
      "title": "Users",
      "type": "array"
    },
    "oauth_applications": {
      "items": {
        "$ref": "#/$defs/OAuthApplication"
      },
      "title": "Oauth Applications",
      "type": "array"
    },
    "third_party_auth_providers": {
      "items": {
        "$ref": "#/$defs/ThirdPartyAuthProvider"
      },
      "title": "Third Party Auth Providers",
      "type": "array"
    },
    "service_access_tokens": {
      "items": {
        "$ref": "#/$defs/ServiceAccessToken"
      },
      "title": "Service Access Tokens",
      "type": "array"
    },
    "waffle_flags": {
      "items": {
        "$ref": "#/$defs/WaffleFlag"
      },
      "title": "Waffle Flags",
      "type": "array"
    },
    "demo_course": {
      "anyOf": [
        {
          "$ref": "#/$defs/DemoCourse"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    }
  },
  "title": "BootstrapSpec",
  "type": "object"
}