permissions.acl

/*
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

/**
 * Sample access control list.
 */

rule ADMIN_RULE{
    description: "Only admin is allowed to create file owners"
    participant: "org.hyperledger.composer.system.NetworkAdmin"
    operation: CREATE
    resource: "org.fileco.com.FileOwner"
    action: ALLOW
}


rule GRANT_ACCESS_RULE{
  description: "only owner of file can grant access to file"
    participant(p): "org.fileco.com.FileOwner"
    operation: ALL
    resource (r): "org.fileco.com.GrantAccess"
    condition: (p.peerId==r.pendinRequest.file.owner.peerId)
    action: ALLOW
}

rule PENDING_REQUEST_RULE{
  description: "only owner of file can grant access to file"
    participant(p): "org.fileco.com.FileOwner"
    operation: ALL
    resource (r): "org.fileco.com.PendingRequest"
    condition: (p.peerId==r.file.owner.peerId)
    action: ALLOW
}


rule PENDING_REQUEST_RULE2{
  description: "only owner of file can grant access to file"
    participant(p): "org.fileco.com.FileOwner"
    operation: ALL
    resource (r): "org.fileco.com.PendingRequest"
    condition: (p.peerId!=r.file.owner.peerId)
    action: DENY
}


rule FILE_A_READ_TO_ALL{
  description: "only owner of file can grant access to file"
    participant: "org.fileco.com.**"
    operation: ALL
    resource: "org.fileco.com.FileA"
    action: ALLOW
}

// rule EverybodyCanReadEverything {
//     description: "Allow all participants read access to all resources"
//     participant: "org.fileco.com.SampleParticipant"
//     operation: READ
//     resource: "org.fileco.com.*"
//     action: ALLOW
// }

// rule EverybodyCanSubmitTransactions {
//     description: "Allow all participants to submit transactions"
//     participant: "org.fileco.com.SampleParticipant"
//     operation: CREATE
//     resource: "org.fileco.com.SampleTransaction"
//     action: ALLOW
// }

// rule OwnerHasFullAccessToTheirAssets {
//     description: "Allow all participants full access to their assets"
//     participant(p): "org.fileco.com.SampleParticipant"
//     operation: ALL
//     resource(r): "org.fileco.com.SampleAsset"
//     condition: (r.owner.getIdentifier() === p.getIdentifier())
//     action: ALLOW
// }

rule SystemACL {
  description:  "System ACL to permit all access"
  participant: "org.hyperledger.composer.system.Participant"
  operation: ALL
  resource: "org.hyperledger.composer.system.**"
  action: ALLOW
}

rule NetworkAdminUser {
    description: "Grant business network administrators full access to user resources"
    participant: "org.hyperledger.composer.system.NetworkAdmin"
    operation: ALL
    resource: "**"
    action: ALLOW
}

rule NetworkAdminSystem {
    description: "Grant business network administrators full access to system resources"
    participant: "org.hyperledger.composer.system.NetworkAdmin"
    operation: ALL
    resource: "org.hyperledger.composer.system.**"
    action: ALLOW
}