permissions.acl

/**
 * Access control rules. These rules allow anyone to submit AuthorizeAccess
 * and RevokeAccess transaction as well as granting full access to a member's
 * own record. A member can access another member's details if the member has
 * added them to their authorized list.
 */


rule AuthorizeAccessTransaction {
    description: "Allow all participants to submit AuthorizeAccess transactions"
    participant: "ANY"
    operation: CREATE
    resource: "org.cse.piinet.AuthorizeAccess"
    action: ALLOW
}

rule RevokeAccessTransaction {
    description: "Allow all participants to submit RevokeAccess transactions"
    participant: "ANY"
    operation: CREATE
    resource: "org.cse.piinet.RevokeAccess"
    action: ALLOW
}

rule GetDataTransaction {
    description: "Allow a participant to submit GetData transaction"
    participant: "ANY"
    operation: CREATE
    resource: "org.cse.piinet.GetData"
    action: ALLOW
}

rule CreateDataAssetAccess {
  description:  "Only Members can create a Data Asset"
  participant: "org.cse.piinet.Member"
  operation: ALL
  resource: "org.cse.piinet.Data"
  action: ALLOW
}

rule OwnAssetFullAccess {
    description: "Allow all participants full access to their own data asset"
    participant(p): "org.cse.piinet.Member"
    operation: ALL
    resource(r): "org.cse.piinet.Data"
    condition: (r.owner.getIdentifier() === p.getIdentifier())
    action: ALLOW
}

rule ForeignAssetConditionalAccess {
    description: "Allow participants access to other people's Data assets if granted"
    participant(p): "org.cse.piinet.Member"
    operation: READ
    resource(r): "org.cse.piinet.Data"
    transaction(tx): "org.cse.piinet.GetData"
    condition: (r.owner.authorized && r.owner.authorized.indexOf(p.getIdentifier()) > -1)
    action: ALLOW
}

rule OwnRecordFullAccess {
    description: "Allow all participants full access to their own record"
    participant(p): "org.cse.piinet.Member"
    operation: ALL
    resource(r): "org.cse.piinet.Member"
    condition: (r.getIdentifier() === p.getIdentifier())
    action: ALLOW
}


rule ForeignRecordInitialReadAccess {
    description: "Allow participants to perform the GetData tranaction as it reads other member data."
    participant(p): "org.cse.piinet.Member"
    operation: READ
    resource(r): "org.cse.piinet.Member"
    condition: (r.authorized && r.authorized.indexOf(p.getIdentifier()) > -1)
    action: ALLOW
}


rule SystemACL {
  description:  "System ACL to permit all access"
  participant: "org.hyperledger.composer.system.Participant"
  operation: ALL
  resource: "org.hyperledger.composer.system.**"
  action: ALLOW
}

rule NetworkAdminUser {
    description: "Grant business network administrators full access to user resources"
    participant: "org.hyperledger.composer.system.NetworkAdmin"
    operation: ALL
    resource: "**"
    action: ALLOW
}

rule NetworkAdminSystem {
    description: "Grant business network administrators full access to system resources"
    participant: "org.hyperledger.composer.system.NetworkAdmin"
    operation: ALL
    resource: "org.hyperledger.composer.system.**"
    action: ALLOW
}