permissions.acl

/* TOP to BOTTOM read order */

//---------/* PRODUCTS */

rule allowWorkerOfCEntityCRUDproducts {
  description: "Workers of Certification Entity CAN CUD Products"
  participant(p): "org.doptrace.Worker"
  operation: ALL
  resource(r): "org.doptrace.DOP_Product"
  condition: (p.operator == org.doptrace.CertificationEntity)
  action: ALLOW
}


rule denyWorkerCUDproducts {
  description: "Workers CAN'T CUD Products"
  participant: "org.doptrace.Worker"
  operation: CREATE, UPDATE, DELETE
  resource: "org.doptrace.Product"
  action: DENY
}


//---------/* BATCHES */
rule denyWorkerCUDbatches {
  description: "Workers CAN'T CUD Batches"
  participant: "org.doptrace.Worker"
  operation: CREATE, UPDATE, DELETE
  resource: "org.doptrace.Batch"
  action: DENY
}

//---------/* EVENTS */
rule denyWorkersCRUDeventsOfDifferentWorkerId {
  description: "Workers CAN'T CRUD events of different Worker ID"
  participant(p): "org.doptrace.Worker"
  operation: ALL
  resource(r): "org.doptrace.Events"
  condition: (p.getIdentifier() != r.worker.getIdentifier())
  action: DENY
}

rule allowWorkersCRUDanalysisOfSameOperatorId {
  description: "Workers CAN ONLY CRUD Analysis of same Operator ID"
  participant(p): "org.doptrace.Worker"
  operation: ALL
  resource(r): "org.doptrace.Analysis"
  condition: (p.operator.getIdentifier() == r.certificationEntity.getIdentifier())
  action: ALLOW
}

rule allowWorkersCRUDtransportOfSameOperatorId {
  description: "Workers CAN ONLY CRUD Transport of same Operator ID"
  participant(p): "org.doptrace.Worker"
  operation: ALL
  resource(r): "org.doptrace.Transport"
  condition: (p.operator.getIdentifier() == r.logistics.getIdentifier())
  action: ALLOW
}

rule allowWorkersCRUDdiscardOfSameOperatorId {
  description: "Workers CAN ONLY CRUD Discard of same Operator ID"
  participant(p): "org.doptrace.Worker"
  operation: ALL
  resource(r): "org.doptrace.Discard"
  condition: (p.operator.getIdentifier() == r.industry_retailer.getIdentifier())
  action: ALLOW
}

rule allowWorkersCRUDsaleOfSameOperatorId {
  description: "Workers CAN ONLY CRUD Sale of same Operator ID"
  participant(p): "org.doptrace.Worker"
  operation: ALL
  resource(r): "org.doptrace.Sale"
  condition: (p.operator.getIdentifier() == r.seller.getIdentifier()
             && p.operator.getIdentifier() != r.buyer.getIdentifier())
  action: ALLOW
}

rule allowWorkersCRUDstorageOfSameOperatorId {
  description: "Workers CAN ONLY CRUD Storage of same Operator ID"
  participant(p): "org.doptrace.Worker"
  operation: ALL
  resource(r): "org.doptrace.Storage"
  condition: (p.operator.getIdentifier() == r.industry_retailer.getIdentifier())
  action: ALLOW
}

rule allowWorkersCRUDtransformationOfSameOperatorId {
  description: "Workers CAN ONLY CRUD Transformation of same Operator ID"
  participant(p): "org.doptrace.Worker"
  operation: ALL
  resource(r): "org.doptrace.Transformation"
  condition: (p.operator.getIdentifier() == r.industry_retailer.getIdentifier())
  action: ALLOW
}

rule allowWorkersCRUDqualityAssessmentOfSameOperatorId {
  description: "Workers CAN ONLY CRUD Quality Assessment of same Operator ID"
  participant(p): "org.doptrace.Worker"
  operation: ALL
  resource(r): "org.doptrace.QualityAssessment"
  condition: (p.operator.getIdentifier() == r.industry_retailer.getIdentifier())
  action: ALLOW
}

rule allowWorkersCRUDproductRegistrationOfSameOperatorId {
  description: "Workers CAN ONLY CRUD Product Registration of same Operator ID"
  participant(p): "org.doptrace.Worker"
  operation: ALL
  resource(r): "org.doptrace.ProductRegistration"
  condition: (p.operator.getIdentifier() == r.producer.getIdentifier())
  action: ALLOW
}

rule denyWorkersCRUDevents {
  description: "Workers CAN'T CRUD other events"
  participant: "org.doptrace.Worker"
  operation: ALL
  resource: "org.doptrace.Events"
  action: DENY
}

//---------/* OPERATORS */
rule denyWorkerCUDoperators {
  description: "Worker CAN'T CUD Operators"
  participant: "org.doptrace.Worker"
  operation: CREATE, UPDATE, DELETE
  resource: "org.doptrace.Operator"
  action: DENY
}

//---------/* USERS */
rule denyCRUDWorkersWithNonExistingOperators {
  description: "Users CAN'T CRUD Workers with a non-existing Operator Id"
  participant(p): "org.doptrace.User"
  operation: CREATE
  resource(r): "org.doptrace.Worker"
  condition: (r.operator.isResource() == false)
  action: DENY
}

rule denyWorkerAdminCUDworkerAdmins  {
  description: "WorkerAdmins CAN'T CUD other WorkerAdmins"
  participant: "org.doptrace.WorkerAdmin"
  operation: CREATE, UPDATE, DELETE
  resource: "org.doptrace.WorkerAdmin"
  action: DENY
}

rule allowWorkerAdminREADworkerAdmin  {
  description: "WorkerAdmins CAN READ other WorkerAdmins"
  participant: "org.doptrace.WorkerAdmin"
  operation: READ
  resource: "org.doptrace.WorkerAdmin"
  action: ALLOW
}

rule allowWorkerAdminCUDworkerOfSameOperatorID{
  description: "WorkerAdmins CAN ONLY CUD Workers of same Operator ID"
  participant(p): "org.doptrace.WorkerAdmin"
  operation: CREATE, UPDATE, DELETE
  resource(v): "org.doptrace.Worker"
  condition: (p.operator.getIdentifier() == v.operator.getIdentifier())
  action: ALLOW
}

rule denyWorkerREADworkerAdmin{
  description: "Workers CAN'T READ WorkerAdmins"
  participant: "org.doptrace.Worker"
  operation: READ
  resource: "org.doptrace.WorkerAdmin"
  action: DENY
}

rule allowWorkerREADworker{
  description: "Workers CAN ONLY READ Workers"
  participant: "org.doptrace.Worker"
  operation: READ
  resource: "org.doptrace.Worker"
  action: ALLOW
}

rule denyWorkerCRUDusers {
  description: "Workers CAN'T CRUD Users"
  participant: "org.doptrace.Worker"
  operation: ALL
  resource: "org.doptrace.User"
  action: DENY
}

//---------/* ACL DEFAULT RULES */
rule Default {
  description: "Allow all participants access to all resources"
  participant: "ANY"
  operation: ALL
  resource: "org.doptrace.*"
  action: ALLOW
}

rule SystemACL {
  description: "System ACL to permit all access"
  participant: "org.hyperledger.composer.system.Participant"
  operation: ALL
  resource: "org.hyperledger.composer.system.**"
  action: ALLOW
}

rule NetworkAdminUser {
  description: "Grant business network administrators full access to user resources"
  participant: "org.hyperledger.composer.system.NetworkAdmin"
  operation: ALL
  resource: "**"
  action: ALLOW
}

rule NetworkAdminSystem {
  description: "Grant business network administrators full access to system resources"
  participant: "org.hyperledger.composer.system.NetworkAdmin"
  operation: ALL
  resource: "org.hyperledger.composer.system.**"
  action: ALLOW
}