Alexander Zobnin
c34394f385
* Zanzana: Support subresources for folders * refactor * fix subresource requests * implement listing for folders subresources * teams subresources PoC * re-enable tests * use team resource def from iam * fix tests * remove unused code * refactor: rename to subresource * split resource schema * update workspaces * rename folder relation to subresource * refactor: rename folder resources to subresources * update readme * fix listing * rename params in subresource filter
33 lines
2.1 KiB
Plaintext
33 lines
2.1 KiB
Plaintext
module resource
|
|
|
|
type group_resource
|
|
relations
|
|
define view: [user, service-account, render, team#member, role#assignee] or edit
|
|
define edit: [user, service-account, team#member, role#assignee] or admin
|
|
define admin: [user, service-account, team#member, role#assignee]
|
|
|
|
define get: [user, service-account, render, team#member, role#assignee] or view
|
|
define create: [user, service-account, team#member, role#assignee] or edit
|
|
define update: [user, service-account, team#member, role#assignee] or edit
|
|
define delete: [user, service-account, team#member, role#assignee] or edit
|
|
|
|
define get_permissions: [user, service-account, render, team#member, role#assignee] or admin
|
|
define set_permissions: [user, service-account, render, team#member, role#assignee] or admin
|
|
|
|
type resource
|
|
relations
|
|
define view: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or edit
|
|
define edit: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or admin
|
|
define admin: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter]
|
|
|
|
define get: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or view
|
|
define update: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or edit
|
|
define delete: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or edit
|
|
|
|
define get_permissions: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or admin
|
|
define set_permissions: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or admin
|
|
|
|
condition group_filter(requested_group: string, group_resource: string) {
|
|
requested_group == group_resource
|
|
}
|