permissions.acl

/*
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */


rule NetworkAdminUser {
    description: "Grant business network administrators full access to user resources"
    participant: "org.hyperledger.composer.system.NetworkAdmin"
    operation: ALL
    resource: "**"
    action: ALLOW
}


rule NetworkAdminSeePatricipants {
    description: "Grant business network administrators full access to user resources"
    participant: "org.hyperledger.composer.system.NetworkAdmin"
    operation: READ, CREATE, UPDATE
    resource: "org.hyperledger.composer.system.Participant"
    action: ALLOW
}

rule NetworkAdminSystem {
    description: "Grant business network administrators full access to system resources"
    participant: "org.hyperledger.composer.system.NetworkAdmin"
    operation: ALL
    resource: "org.hyperledger.composer.system.**"
    action: ALLOW
}

rule ParticipantsNetworkAcces {
    description: "Grant network access to all participants"
    participant: "org.hyperledger.composer.system.Participant"
    operation: READ, CREATE, UPDATE
    resource: "org.hyperledger.composer.system.Network"
    action: ALLOW
}

rule ParticipantRegistry {
    description: "Grant AssetRegistry to all participants"
    participant: "org.hyperledger.composer.system.Participant"
    operation: READ
    resource: "org.hyperledger.composer.system.Registry"
    action: ALLOW
}

rule RegulatorAll {
    description: "Regulators can do everything"
    participant: "net.aidin.marketplace.Regulator"
    operation: ALL
    resource: "**"
    action: ALLOW
}

rule ParticipantTransaction {
    description: "Brokers can create member"
    participant: "org.hyperledger.composer.system.Participant"
    operation: CREATE
    resource: "org.hyperledger.composer.system.Transaction"
    action: ALLOW
}

rule RegulatorTransaction {
    description: "Brokers can create member"
    participant: "net.aidin.marketplace.Regulator"
    operation: CREATE, READ
    resource: "org.hyperledger.composer.system.Transaction"
    action: ALLOW
}

rule ParticipantHistorianRecord {
    description: "Brokers can create historian records"
    participant: "org.hyperledger.composer.system.Participant"
    operation: CREATE
    resource: "org.hyperledger.composer.system.HistorianRecord"
    action: ALLOW
}

rule BrokerCreateMember {
    description: "Brokers can create member"
    participant(b): "net.aidin.marketplace.Broker"
    operation: CREATE
    resource(m): "net.aidin.marketplace.Member"
    condition: (m.balance === 0 && (m.brokers.length === 0 || (m.brokers.length === 1 && m.brokers[0].getFullyQualifiedIdentifier() === b.getFullyQualifiedIdentifier())))
    action: ALLOW
}

rule BrokerAddMember {
    description: "Broker can register members"
    participant: "net.aidin.marketplace.Broker"
    operation: READ, UPDATE
    resource: "net.aidin.marketplace.Member"
    transaction: "net.aidin.marketplace.RegisterMemberToBroker"
    action: ALLOW
}

rule BrokerRemoveMember {
    description: "Broker can remove memeber"
    participant(b): "net.aidin.marketplace.Broker"
    operation: READ, UPDATE
    resource(m): "net.aidin.marketplace.Member"
    transaction(t): "net.aidin.marketplace.RemoveMemberFromBroker"
    condition: (m.brokers.reduce(function(res, br){return res || br.getFullyQualifiedIdentifier() === b.getFullyQualifiedIdentifier()}, false))
    action: ALLOW
}

rule BrokerCharge {
    description: "Broker can charge memeber blance"
    participant(b): "net.aidin.marketplace.Broker"
    operation: READ, UPDATE
    resource(m): "net.aidin.marketplace.Member"
    transaction(t): "net.aidin.marketplace.ChargeMemberBalance"
    condition: (m.brokers.reduce(function(res, br){return res || br.getFullyQualifiedIdentifier() === b.getFullyQualifiedIdentifier()}, false))
    action: ALLOW
}

rule BrokerWithdraw {
    description: "Broker can withdraw from memeber blance"
    participant(b): "net.aidin.marketplace.Broker"
    operation: READ, UPDATE
    resource(m): "net.aidin.marketplace.Member"
    transaction(t): "net.aidin.marketplace.WithdrawMemberBalance"
    condition: (m.brokers.reduce(function(res, br){return res || br.getFullyQualifiedIdentifier() === b.getFullyQualifiedIdentifier()}, false))
    action: ALLOW
}

rule BrokersProfile {
  description: "Brokers can see and update their own record only"
  participant(t): "net.aidin.marketplace.Broker"
  operation: READ, UPDATE
  resource(v): "net.aidin.marketplace.Broker"
  condition: (v.getFullyQualifiedIdentifier() == t.getFullyQualifiedIdentifier())
  action: ALLOW
}

rule BrokersCreateCoin {
  description: "Brokers can create coin when buyed by a member"
  participant(b): "net.aidin.marketplace.Broker"
  operation: CREATE
  resource: "net.aidin.marketplace.Coin"
  transaction(t): "net.aidin.marketplace.SellCoinToMember"
  condition: (t.member.brokers.reduce(function(res, br){return res || br.getFullyQualifiedIdentifier() === b.getFullyQualifiedIdentifier()}, false))
  action: ALLOW
}

rule BrokersCreateCoinMember {
    description: "Broker can withdraw from memeber blance"
    participant(b): "net.aidin.marketplace.Broker"
    operation: UPDATE
    resource(m): "net.aidin.marketplace.Member"
    transaction(t): "net.aidin.marketplace.SellCoinToMember"
    condition: (m.balance > t.price && m.brokers.reduce(function(res, br){return res || br.getFullyQualifiedIdentifier() === b.getFullyQualifiedIdentifier()}, false))
    action: ALLOW
}

rule MembersProfile {
  description: "Members can see all profiles"
  participant: "net.aidin.marketplace.Member"
  operation: READ
  resource: "net.aidin.marketplace.Member"
  action: ALLOW
}

rule BrokersSeeProfiles {
  description: "Brokers can see all profiles"
  participant: "net.aidin.marketplace.Broker"
  operation: READ
  resource: "net.aidin.marketplace.Member"
  action: ALLOW
}

rule BrokersSeeCoin {
  description: "Brokers can see all coins sold by them"
  participant(b): "net.aidin.marketplace.Broker"
  operation: READ
  resource(c): "net.aidin.marketplace.Coin"
  condition: (c.issuer.getFullyQualifiedIdentifier() === b.getFullyQualifiedIdentifier())
  action: ALLOW
}

rule MembersHistory {
  description: "Members should be able to see the history of their own transactions only"
  participant(m): "net.aidin.marketplace.Member"
  operation: READ
  resource(v): "org.hyperledger.composer.system.HistorianRecord"
  condition: (v.participantInvoking.getFullyQualifiedIdentifier() === m.getFullyQualifiedIdentifier())
  action: ALLOW
}

rule BrokersHistory {
  description: "Brokers should be able to see the history of their own transactions only"
  participant(b): "net.aidin.marketplace.Broker"
  operation: READ
  resource(v): "org.hyperledger.composer.system.HistorianRecord"
  condition: (v.participantInvoking.getFullyQualifiedIdentifier() === b.getFullyQualifiedIdentifier())
  action: ALLOW
}

rule MembersCoins {
  description: "Access to see coins for members"
  participant(m): "net.aidin.marketplace.Member"
  operation: READ
  resource(c): "net.aidin.marketplace.Coin"
  condition: (c.owner.getFullyQualifiedIdentifier() === m.getFullyQualifiedIdentifier())
  action: ALLOW
}

rule BrokerIds {
  description: "Access to ids"
  participant(b): "net.aidin.marketplace.Broker"
  operation: ALL
  resource(i): "org.hyperledger.composer.system.Identity"
  condition: (i.participant.getFullyQualifiedIdentifier() === b.getFullyQualifiedIdentifier() || i.participant.brokers.reduce(function(res, br){return res || br.getFullyQualifiedIdentifier() === b.getFullyQualifiedIdentifier()}, false))
  action: ALLOW
}

rule MembersSeeBrokers {
  description: "Access to see brokers for members"
  participant: "net.aidin.marketplace.Member"
  operation: READ
  resource: "net.aidin.marketplace.Broker"
  action: ALLOW
}

rule MembersCoinOffer {
  description: "Access to crud offers"
  participant(m): "net.aidin.marketplace.Member"
  operation: UPDATE, CREATE, DELETE
  resource(co): "net.aidin.marketplace.CoinOffer"
  condition: (co.status === 'NEW' && m.getFullyQualifiedIdentifier() === co.owner.getFullyQualifiedIdentifier() && m.getFullyQualifiedIdentifier() === co.coin.owner.getFullyQualifiedIdentifier())
  action: ALLOW
}

rule MembersSeeCoinOffer {
  description: "Access to offers"
  participant: "net.aidin.marketplace.Member"
  operation: READ
  resource(co): "net.aidin.marketplace.CoinOffer"
  condition: (co.status === 'NEW')
  action: ALLOW
}

rule MemberBuyCoin1 {
    description: "Member buy coin"
    participant(m): "net.aidin.marketplace.Member"
    operation: READ, UPDATE
    resource(c): "net.aidin.marketplace.Coin"
    transaction(tx): "net.aidin.marketplace.BuyCoinFromMember"
    condition: (m.balance > tx.offer.price && tx.offer.coin.getFullyQualifiedIdentifier() === c.getFullyQualifiedIdentifier() && c.owner.getFullyQualifiedIdentifier() === tx.offer.owner.getFullyQualifiedIdentifier() && m.getFullyQualifiedIdentifier() !== tx.offer.owner.getFullyQualifiedIdentifier() )
    action: ALLOW
}

rule MemberBuyCoin2 {
    description: "Member buy coin"
    participant(m): "net.aidin.marketplace.Member"
    operation: UPDATE
    resource(co): "net.aidin.marketplace.CoinOffer"
    transaction(tx): "net.aidin.marketplace.BuyCoinFromMember"
    condition: (co.status === 'NEW' && m.balance > tx.offer.price && tx.offer.getFullyQualifiedIdentifier() === co.getFullyQualifiedIdentifier())
    action: ALLOW
}

rule MemberBuyCoin3 {
    description: "Member buy coin"
    participant(m): "net.aidin.marketplace.Member"
    operation: READ, UPDATE
    resource(mo): "net.aidin.marketplace.Member"
    transaction(tx): "net.aidin.marketplace.BuyCoinFromMember"
    condition: (m.balance > tx.offer.price && (m.getFullyQualifiedIdentifier() === mo.getFullyQualifiedIdentifier() || mo.getFullyQualifiedIdentifier() === tx.offer.owner.getFullyQualifiedIdentifier()))
    action: ALLOW
}



rule BrokerBuyCoinFromMember {
    description: "Brokers can create member"
    participant: "net.aidin.marketplace.Broker"
    operation: ALL
    resource: "net.aidin.marketplace.BuyCoinFromMember"
    action: DENY
}


rule MemberSellCoinToMember{
    description: "Brokers can create member"
    participant(m): "net.aidin.marketplace.Member"
    operation: READ
    resource(tx): "net.aidin.marketplace.SellCoinToMember"
    condition: (tx.member.getFullyQualifiedIdentifier() === m.getFullyQualifiedIdentifier())
    action: ALLOW
}

rule MemberBuyCoinOffer{
    description: "Brokers can create member"
    participant(m): "net.aidin.marketplace.Member"
    operation: READ
    resource(tx): "net.aidin.marketplace.BuyCoinFromMember"
    condition: (tx.offer.owner.getFullyQualifiedIdentifier() === m.getFullyQualifiedIdentifier())
    action: ALLOW
}

rule MemberChargeMemberBalance{
    description: "Brokers can create member"
    participant(m): "net.aidin.marketplace.Member"
    operation: READ
    resource(tx): "net.aidin.marketplace.ChargeMemberBalance"
    condition: (tx.member.getFullyQualifiedIdentifier() === m.getFullyQualifiedIdentifier())
    action: ALLOW
}

rule MemberRegisterMemberToBroker{
    description: "Brokers can create member"
    participant(m): "net.aidin.marketplace.Member"
    operation: READ
    resource(tx): "net.aidin.marketplace.RegisterMemberToBroker"
    condition: (tx.member.getFullyQualifiedIdentifier() === m.getFullyQualifiedIdentifier())
    action: ALLOW
}

rule MemberRemoveMemberFromBroker{
    description: "Brokers can create member"
    participant(m): "net.aidin.marketplace.Member"
    operation: READ
    resource(tx): "net.aidin.marketplace.RemoveMemberFromBroker"
    condition: (tx.member.getFullyQualifiedIdentifier() === m.getFullyQualifiedIdentifier())
    action: ALLOW
}

rule MemberWithdrawMemberBalance{
    description: "Brokers can create member"
    participant(m): "net.aidin.marketplace.Member"
    operation: READ
    resource(tx): "net.aidin.marketplace.WithdrawMemberBalance"
    condition: (tx.member.getFullyQualifiedIdentifier() === m.getFullyQualifiedIdentifier())
    action: ALLOW
}