Security Figure is missing proxy term

ontology/wotsec.html

@@ -48,15 +48,15 @@ <h2>Introduction</h2>
 <section id="SecurityScheme"><h4>SecurityScheme</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#SecurityScheme</code></p><span><p>Metadata describing the configuration of a security mechanism. <span class="rfc2119-assertion" id="td-security-scheme-name">The value assigned to the name <code>scheme</code> <em class="rfc2119" title="MUST">MUST</em> be defined within a <a href="#dfn-vocab-term" class="internalDFN" data-link-type="dfn">Vocabulary</a> included in the <a href="#dfn-thing-description" class="internalDFN" data-link-type="dfn">Thing Description</a>, either in the standard <a href="#dfn-vocab-term" class="internalDFN" data-link-type="dfn">Vocabulary</a> defined in <a href="#sec-vocabulary-definition" class="sec-ref">§&nbsp;<bdi class="secno">5.</bdi> TD Information Model</a> or in a <a href="#dfn-context-ext" class="internalDFN" data-link-type="dfn">TD Context Extension</a>.</span> </p><p> <span class="rfc2119-assertion" id="td-security-no-secrets">For all security schemes, any keys, passwords, or other sensitive information directly providing access <em class="rfc2119" title="MUST NOT">MUST NOT</em> be stored in the TD and should instead be shared and stored out-of-band via other mechanisms.</span> The purpose of a TD is to describe how to access a Thing if and only if a Consumer already has authorization, and is not meant be used to grant that authorization.</p><p>Each security scheme object used in a TD defines a set of requirements to be met before access can be granted.  We say a security scheme is <em>satisfied</em> when all its requirements are met.  In some cases requirements from multiple security schemes will have to be met before access can be granted.</p><p>Security schemes generally may require additional authentication parameters, such as a password or key.  The location of this information is indicated by the value associated with the name <code>in</code>, often in combination with the value associated with <code>name</code>.  The <code>in</code> name can take one of the following values: <dl> <dt><code>header</code>:</dt> <dd>The parameter will be given in a header provided by the protocol, with the name of the header provided by the value of <code>name</code>.</dd> <dt><code>query</code>:</dt> <dd>The parameter will be appended to the URI as a query parameter, with the name of the query parameter provided by <code>name</code>.</dd> <dt><code>body</code>:</dt> <dd>The parameter will be provided in the body of the request payload, with the data schema element  used provided by <code>name</code>. <span class="rfc2119-assertion" id="sec-body-name-json-pointer">When used in the context of a <code>body</code> security information location, the value of <code>name</code> <em class="rfc2119" title="MUST">MUST</em> be in the form of a JSON pointer [[!RFC6901]] relative to the root of the input <code>DataSchema</code> for each interaction it is used with.</span> Since this value is not a fragment identifier, and is not relative to the root of the TD but to whichever data schemas the security scheme is bound to, this value should not start with "<code>#</code>"; it is a "pure" JSON pointer. Since this value is not a fragment identifier, it also does not need to URL-encode special characters.  The targeted element may or may not already exist at the specified location in the referenced data schema.  If it does not, it will be inserted. This avoids having to duplicate definitions in the data schemas of every interaction.  <span class="rfc2119-assertion" id="sec-body-name-json-pointer-creatable">When an element of a data schema indicated by a JSON pointer indicated in a <code>body</code> locator does not already exist in the indicated schema, it <em class="rfc2119" title="MUST">MUST</em> be possible to insert the indicated element at the location indicated by the pointer.</span>. For example, pointing to a key of a Map where that key does not exist in the corresponding Data Schema, the key and its value, which is the credential, would be inserted to the Map at the specified location during the operation execution. On the other hand, pointing to an Array's item with a number as the item index, that number should be outside the range of the Array's already specified items in order to not alter the strict sequence of items. <span class="rfc2119-assertion" id="sec-body-name-json-pointer-array">The JSON pointer used in the <code>body</code> locator <em class="rfc2119" title="MAY">MAY</em> use the "<code>-</code>" character to indicate a non-existent array element when it is necessary to insert an element after the last element of an existing array.</span> <span class="rfc2119-assertion" id="sec-body-name-json-pointer-type">The element referenced (or created) by a <code>body</code> security information location <em class="rfc2119" title="MUST">MUST</em> be required and of type "<code>string</code>".</span> If <code>name</code> is not given, it is assumed the entire body is to be used as the security parameter.  </dd> <dt><code>cookie</code>:</dt> <dd>The parameter is stored in a cookie identified by the value of <code>name</code>.  </dd> <dt><code>uri</code>:</dt> <dd>The parameter is embedded in the URI itself, which is encoded in the relevant interaction using a URI template variable defined by the value of <code>name</code>.  This is more general than the <code>query</code> mechanism but more complex.  <span class="rfc2119-assertion" id="td-security-in-query-over-uri">The value <code>uri</code> <em class="rfc2119" title="SHOULD">SHOULD</em> be specified for <code>in</code> in a security scheme only if <code>query</code> is not applicable.</span>  <span class="rfc2119-assertion" id="td-security-in-uri-variable">The URIs provided in interactions where a security scheme using <code>uri</code> <em class="rfc2119" title="MUST">MUST</em> be a URI template including the defined variable.</span></dd><dt><code>auto</code>:</dt><dd>The location is determined as part of the protocol, or negotiated. <span class="rfc2119-assertion" id="sec-security-vocab-auto-in-no-name">If a value of <code>auto</code> is set for the <code>in</code> field of a <code>SecurityScheme</code>, then the <code>name</code> field SHOULD NOT be set.</span> In this case, the application of the <code>SecurityScheme</code> is subject to the respective specification for the given protocol (e.g. [[!RFC8288]] when using the <code>BasicSecurityScheme</code> with HTTP).</dd></dl> If multiple parameters are needed for a security scheme, repeat the security scheme definition for each parameter and combine them using a <code>combo</code> security scheme and <code>allOf</code>.  In some cases parameters may not actually be secret but a user may wish to leave them out of the TD to help protect privacy.  As an example of this, some security mechanisms require both a client identifier and a secret key. In theory, the client identifier is public however it may be hard to update and pose a tracking risk. In such a case it can be provided as an additional security parameter so it does not appear in the TD.</p><p><span class="rfc2119-assertion" id="td-security-uri-variables-distinct">The names of URI variables declared in a <code>SecurityScheme</code> <em class="rfc2119" title="MUST">MUST</em> be distinct from all other URI variables declared in the TD.</span></p></span><table class="def numbered"><tbody><tr><td>Super-class of</td><td><code><a href="#APIKeySecurityScheme">wotsec:APIKeySecurityScheme</a></code><br><code><a href="#AutoSecurityScheme">wotsec:AutoSecurityScheme</a></code><br><code><a href="#BasicSecurityScheme">wotsec:BasicSecurityScheme</a></code><br><code><a href="#BearerSecurityScheme">wotsec:BearerSecurityScheme</a></code><br><code><a href="#ComboSecurityScheme">wotsec:ComboSecurityScheme</a></code><br><code><a href="#DigestSecurityScheme">wotsec:DigestSecurityScheme</a></code><br><code><a href="#NoSecurityScheme">wotsec:NoSecurityScheme</a></code><br><code><a href="#OAuth2SecurityScheme">wotsec:OAuth2SecurityScheme</a></code><br><code><a href="#PSKSecurityScheme">wotsec:PSKSecurityScheme</a></code></td></tr><tr><td>In the domain of</td><td><code><a href="#proxy">wotsec:proxy</a></code><br><code><a href="https://www.w3.org/2019/wot/td#description">td:description</a></code><br><code><a href="https://www.w3.org/2019/wot/td#descriptionInLanguage">td:descriptionInLanguage</a></code><br><code><a href="https://www.w3.org/2019/wot/td#hasConfigurationInstance">td:hasConfigurationInstance</a></code></td></tr></tbody></table></section></section><section><h3>Object Properties</h3><section id="allOf"><h4>allOf</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#allOf</code></p><span>Array of two or more strings identifying other named security scheme definitions, all of which must be satisfied for access.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#ComboSecurityScheme">wotsec:ComboSecurityScheme</a></code></td></tr></tbody></table></section>
 <section id="authorization"><h4>authorization</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#authorization</code></p><span>URI of the authorization server.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#BearerSecurityScheme">wotsec:BearerSecurityScheme</a></code><br><code><a href="#OAuth2SecurityScheme">wotsec:OAuth2SecurityScheme</a></code></td></tr></tbody></table></section>
 <section id="oneOf"><h4>oneOf</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#oneOf</code></p><span>Array of two or more strings identifying other named security scheme definitions, any one of which, when satisfied, will allow access.  Only one may be chosen for use.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#ComboSecurityScheme">wotsec:ComboSecurityScheme</a></code></td></tr></tbody></table></section>
-<section id="proxy"><h4>proxy</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#proxy</code></p><span>URI of the proxy server this security configuration provides access to.  If not given, the corresponding security configuration is for the endpoint.  <br/>This feature is at risk.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#SecurityScheme">wotsec:SecurityScheme</a></code></td></tr></tbody></table></section>
 <section id="refresh"><h4>refresh</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#refresh</code></p><span>URI of the refresh server.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#OAuth2SecurityScheme">wotsec:OAuth2SecurityScheme</a></code></td></tr></tbody></table></section>
 <section id="token"><h4>token</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#token</code></p><span>URI of the token server.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#OAuth2SecurityScheme">wotsec:OAuth2SecurityScheme</a></code></td></tr></tbody></table></section></section><section><h3>Datatype Properties</h3><section id="alg"><h4>alg</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#alg</code></p><span>Encoding, encryption, or digest algorithm.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#BearerSecurityScheme">wotsec:BearerSecurityScheme</a></code></td></tr></tbody></table></section>
 <section id="apikeyIn"><h4>in</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#apikeyIn</code></p><span>Specifies the location of security authentication information.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#APIKeySecurityScheme">wotsec:APIKeySecurityScheme</a></code></td></tr></tbody></table></section>
 <section id="flow"><h4>flow</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#flow</code></p><span>Authorization flow.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#OAuth2SecurityScheme">wotsec:OAuth2SecurityScheme</a></code></td></tr></tbody></table></section>
 <section id="format"><h4>format</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#format</code></p><span>Specifies format of security authentication information.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#BearerSecurityScheme">wotsec:BearerSecurityScheme</a></code></td></tr></tbody></table></section>
 <section id="identity"><h4>identity</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#identity</code></p><span>Identifier providing information which can be used for selection or confirmation.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#PSKSecurityScheme">wotsec:PSKSecurityScheme</a></code></td></tr></tbody></table></section>
-<section id="in"><h4>in</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#in</code></p><span>Specifies the location of security authentication information.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#BasicSecurityScheme">wotsec:BasicSecurityScheme</a></code><br><code><a href="#BearerSecurityScheme">wotsec:BearerSecurityScheme</a></code><br><code><a href="#DigestSecurityScheme">wotsec:DigestSecurityScheme</a></code></td></tr></tbody></table></section>
-<section id="name"><h4>name</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#name</code></p><span>Name for query, header, cookie, or uri parameters.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#APIKeySecurityScheme">wotsec:APIKeySecurityScheme</a></code><br><code><a href="#BasicSecurityScheme">wotsec:BasicSecurityScheme</a></code><br><code><a href="#BearerSecurityScheme">wotsec:BearerSecurityScheme</a></code><br><code><a href="#DigestSecurityScheme">wotsec:DigestSecurityScheme</a></code></td></tr></tbody></table></section>
+<section id="in"><h4>in</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#in</code></p><span>Specifies the location of security authentication information.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#BasicSecurityScheme">wotsec:BasicSecurityScheme</a></code><br><code><a href="#BearerSecurityScheme">wotsec:BearerSecurityScheme</a></code><br><code><a href="#DigestSecurityScheme">wotsec:DigestSecurityScheme</a></code><br><code><a href="#PoPSecurityScheme">wotsec:PoPSecurityScheme</a></code></td></tr></tbody></table></section>
+<section id="name"><h4>name</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#name</code></p><span>Name for query, header, cookie, or uri parameters.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#APIKeySecurityScheme">wotsec:APIKeySecurityScheme</a></code><br><code><a href="#BasicSecurityScheme">wotsec:BasicSecurityScheme</a></code><br><code><a href="#BearerSecurityScheme">wotsec:BearerSecurityScheme</a></code><br><code><a href="#DigestSecurityScheme">wotsec:DigestSecurityScheme</a></code><br><code><a href="#PoPSecurityScheme">wotsec:PoPSecurityScheme</a></code></td></tr></tbody></table></section>
+<section id="proxy"><h4>proxy</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#proxy</code></p><span>URI of the proxy server this security configuration provides access to.  If not given, the corresponding security configuration is for the endpoint.  <br/>This feature is at risk.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#SecurityScheme">wotsec:SecurityScheme</a></code></td></tr><tr><td>Range includes</td><td></td></tr></tbody></table></section>
 <section id="qop"><h4>qop</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#qop</code></p><span>Quality of protection.  <br/>This feature is at risk.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#DigestSecurityScheme">wotsec:DigestSecurityScheme</a></code></td></tr></tbody></table></section>
 <section id="scopes"><h4>scopes</h4><p>IRI: <code>https://www.w3.org/2019/wot/security#scopes</code></p><span>Set of authorization scope identifiers provided as an array.  These are provided in tokens returned by an authorization server and associated with forms in order to identify what resources a client may access and how.  The values associated with a form should be chosen from those defined in an <code>OAuth2SecurityScheme</code> active on that form.  <br/>This feature is at risk.</span><table class="def numbered"><tbody><tr><td>Domain includes</td><td><code><a href="#OAuth2SecurityScheme">wotsec:OAuth2SecurityScheme</a></code></td></tr></tbody></table></section></section><section><h3>Annotation Properties</h3><p>No AnnotationProperty found in the ontology.</p></section></section>
 

ontology/wotsec.ttl

@@ -68,10 +68,11 @@
     rdfs:comment "Set of authorization scope identifiers provided as an array.  These are provided in tokens returned by an authorization server and associated with forms in order to identify what resources a client may access and how.  The values associated with a form should be chosen from those defined in an <code>OAuth2SecurityScheme</code> active on that form.  <br/>This feature is at risk."@en ;
     schema:domainIncludes :OAuth2SecurityScheme .
 
-:proxy rdf:type owl:ObjectProperty ;
+:proxy rdf:type owl:DatatypeProperty ;
     rdfs:label "proxy" ;
     rdfs:comment "URI of the proxy server this security configuration provides access to.  If not given, the corresponding security configuration is for the endpoint.  <br/>This feature is at risk."@en ;
-    schema:domainIncludes :SecurityScheme .
+    schema:domainIncludes :SecurityScheme ;
+    schema:rangeIncludes xsd:anyURI .
 
 :authorization rdf:type owl:ObjectProperty ;
     rdfs:label "authorization" ;