permissions.acl

/**
 * Blockchain for data privacy access control list.
 */

rule DM_Global {
    description: "Allow DataManagers access to all resources"
    participant: "org.data.privacyNetwork.DataManager"
    operation: ALL
    resource: "org.data.privacyNetwork"
    action: ALLOW
}

rule AA_AA_Full {
    description: "Allow AA with Full Access all access to AA it created but not to itself"
    participant (p): "org.data.privacyNetwork.AuthorizedAgent"
    operation: READ, CREATE, UPDATE
    resource (r): "org.data.privacyNetwork.AuthorizedAgent"
    condition: (p.fullAuthorizations.length > 0 && p.email !== r.email && p.organization === r.organization)
    action: ALLOW
}

rule AA_AA_Self {
    description: "Allow AA read access to itself"
    participant (p): "org.data.privacyNetwork.AuthorizedAgent"
    operation: READ
    resource (r): "org.data.privacyNetwork.AuthorizedAgent"
    condition: (p.email === r.email)
    action: ALLOW
}

rule AA_AE_Push {
    description: "Allow AA with Push Access READ, CREATE, UPDATE access to AE"
    participant (p): "org.data.privacyNetwork.AuthorizedAgent"
    operation: READ, CREATE, UPDATE
    resource (r): "org.data.privacyNetwork.AssociatedEntity"
    condition: (p.pushAuthorizations > 0)
    action: ALLOW
}

rule AA_R_Push {
    description: "Allow AA with Push Access READ, UPDATE access to Records"
    participant (p): "org.data.privacyNetwork.AuthorizedAgent"
    operation: READ, UPDATE
    resource (r): "org.data.privacyNetwork.Record"
    condition: (p.pushAuthorizations > 0)
    action: ALLOW
}


rule AE_AE_Access {
    description: "Allow AE to read and update themselves"
    participant (p): "org.data.privacyNetwork.AssociatedEntity"
    operation: READ, UPDATE
    resource (r): "org.data.privacyNetwork.AssociatedEntity"
    condition: (p.email === r.email)
    action: ALLOW
}

rule DU_AA_Access {
    description: "Allow DU to access AA in their organization"
    participant (p): "org.data.privacyNetwork.DataUser"
    operation: UPDATE, CREATE, READ
    resource (r): "org.data.privacyNetwork.AuthorizedAgent"
    condition: (p.organization === r.organization)
    action: ALLOW
}

rule AA_DU_Push {
    description: "Allow AA with Push Access READ, UPDATE access to DU"
    participant (p): "org.data.privacyNetwork.AuthorizedAgent"
    operation: READ, UPDATE
    resource (r): "org.data.privacyNetwork.DataUser"
    condition: (p.pushAuthorizations > 0)
    action: ALLOW
}

rule AE_R_Associate {
    description: "Allow AE READ access to Record if Associated"
    participant (p): "org.data.privacyNetwork.AssociatedEntity"
    operation: READ
    resource (r): "org.data.privacyNetwork.Record"
    condition: (p.students.includes(r.recordId))
    action: ALLOW
}