51 lines
4.0 KiB
Plaintext
51 lines
4.0 KiB
Plaintext
module resource
|
|
|
|
extend type folder
|
|
relations
|
|
define resource_view: [user, service-account, team#member, role#assignee] or resource_edit or resource_view from parent
|
|
define resource_edit: [user, service-account, team#member, role#assignee] or resource_admin or resource_edit from parent
|
|
define resource_admin: [user, service-account, team#member, role#assignee] or resource_admin from parent
|
|
|
|
define resource_get: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_view or resource_get from parent
|
|
define resource_create: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_edit or resource_create from parent
|
|
define resource_update: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_edit or resource_update from parent
|
|
define resource_delete: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_edit or resource_delete from parent
|
|
|
|
define resource_get_permissions: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_admin or resource_get_permissions from parent
|
|
define resource_set_permissions: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_admin or resource_set_permissions from parent
|
|
|
|
type group_resource
|
|
relations
|
|
define view: [user, service-account, render, team#member, role#assignee] or edit
|
|
define edit: [user, service-account, team#member, role#assignee] or admin
|
|
define admin: [user, service-account, team#member, role#assignee]
|
|
|
|
define get: [user, service-account, render, team#member, role#assignee] or view
|
|
define create: [user, service-account, team#member, role#assignee] or edit
|
|
define update: [user, service-account, team#member, role#assignee] or edit
|
|
define delete: [user, service-account, team#member, role#assignee] or edit
|
|
|
|
define get_permissions: [user, service-account, render, team#member, role#assignee] or admin
|
|
define set_permissions: [user, service-account, render, team#member, role#assignee] or admin
|
|
|
|
type resource
|
|
relations
|
|
define view: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or edit
|
|
define edit: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or admin
|
|
define admin: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter]
|
|
|
|
define get: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or view
|
|
define update: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or edit
|
|
define delete: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or edit
|
|
|
|
define get_permissions: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or admin
|
|
define set_permissions: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or admin
|
|
|
|
condition group_filter(requested_group: string, group_resource: string) {
|
|
requested_group == group_resource
|
|
}
|
|
|
|
condition folder_group_filter(requested_group: string, group_resources: list<string>) {
|
|
requested_group in group_resources
|
|
}
|