ts policy

Show or replace the launch policy — the document that decides which applications clients may run and how. Editing it is a read, edit, write cycle against a plain JSON file.

Usage

ts policy [print | set <file> | schema] [--version=N]

Description

ts policy with no action prints the complete policy document as it was authored, stamped with the URL of its schema — never the copy a client of an older policy contract is served — so redirecting it to a file and writing it back is a faithful round trip.

ts policy set <file> replaces the policy. The server validates the document when it is set, before storing it, and signs the copy it serves to each client. A document that is not valid JSON is rejected, and so is one that names a property the server does not model, because a property nothing reads is a silent no-op; a property the stored document already holds is let through, so an older document stays saveable. An empty file is refused before anything is sent. Pass - instead of a path to read from standard input.

ts policy schema prints the JSON schema, which is useful for editor completion and for validating a document before you send it.

Printing and replacing the policy take a Server Administrator. Replacing it is recorded in the audit log, attributed to the account that ran the command.

Options

Flag	Description	Default/Values	Notes
--version	Schema version to fetch.	Default: current	Only meaningful with schema.

Examples

# Look at the current policy
ts policy

# The usual edit cycle
ts policy > policy.json
$EDITOR policy.json
ts policy set policy.json

# Pipe from another tool
jq '.apps += [{"id":"acme"}]' policy.json | ts policy set -

# Save the schema for your editor
ts policy schema > policy.schema.json

Output

print and schema emit JSON on standard output and nothing else, so they pipe cleanly. set reports success:

Policy updated from policy.json

A rejected document explains what was wrong:

Error: Policy contains properties this server does not model, so they would be
stored but never applied or served to any client. Remove them or add them to the
policy model.

Exit Codes

0 on success. -1 when the action is unknown, the file is empty, or the server rejects the document. -4 when no account is signed in, and when the account is not a Server Administrator, which the server reports as Service scope 'api:admin' is required. -6 when the file does not exist, and when schema names a version the server has no schema for.

Related Commands

• ts audit — See who changed the policy and when.
• Launcher policy — What the policy document means.