fix(unauth): fix contact_point meta, add rules for customer and addre…

…ss and contact_point
restorecommerce · Jul 31, 2024 · d624b6a · d624b6a
1 parent 7cbb5e8
commit d624b6a
Show file tree

Hide file tree

Showing 5 changed files with 43 additions and 2 deletions.
diff --git a/datasets/demo-shop/data/seed-data/addresses.yaml b/datasets/demo-shop/data/seed-data/addresses.yaml
@@ -20,7 +20,7 @@
         value: urn:restorecommerce:acs:model:organization.Organization
         attributes:
           - id: urn:restorecommerce:acs:names:ownerInstance
-            value: restorecommerce-demo-shop-organization-000
+            value: restorecommerce-demo-shop-000-organization
 ---
   id: restorecommerce-demo-customer-000-address-000
   postcode: '23456'

diff --git a/datasets/demo-shop/data/seed-data/contact_points.yaml b/datasets/demo-shop/data/seed-data/contact_points.yaml
@@ -17,7 +17,7 @@
         value: urn:restorecommerce:acs:model:organization.Organization
         attributes:
           - id: urn:restorecommerce:acs:names:ownerInstance
-            value: restorecommerce-demo-shop-organization-000
+            value: restorecommerce-demo-shop-000-organization
 ---
   id: restorecommerce-demo-customer-000-contact-point
   physicalAddressId: restorecommerce-demo-customer-000-address-000

diff --git a/datasets/demo-shop/data/seed-data/users.yaml b/datasets/demo-shop/data/seed-data/users.yaml
@@ -8,6 +8,12 @@
   roleAssociations:
     - id: restorecommerce-demo-shops-organization-unauthenticated-r-id
       role: unauthenticated-r-id
+      attributes:
+        - id: urn:restorecommerce:acs:names:roleScopingEntity
+          value: urn:restorecommerce:acs:model:user.User
+          attributes:
+            - id: urn:restorecommerce:acs:names:roleScopingInstance
+              value: restorecommerce-demo-unauthenticated-user
     - id: restorecommerce-demo-shops-organization-customer-r-id
       role: customer-r-id
       attributes:

diff --git a/datasets/system/data/seed-data/policies.yaml b/datasets/system/data/seed-data/policies.yaml
@@ -15,6 +15,7 @@
     - sales-permits-all-hr-scoped
     - moderator-permits-all-hr-scoped
     - member-permits-read-hr-scoped
+    - customer-permits-read-hr-scoped
     - user-permits-all-owned
     - permit-read-strict-scoped
     - domainless-unauthenticated-permits-read-system
@@ -66,6 +67,8 @@
   rules:
     - administrator-permits-all-hr-scoped
     - permit-read-strict-scoped
+    - sales-permits-read-hr-scoped
+    - customer-permits-read-hr-scoped
     - domainless-unauthenticated-permits-read-system
     - fallback-deny-all
   meta:
@@ -92,6 +95,7 @@
   rules:
     - administrator-permits-all-hr-scoped
     - sales-permits-read-hr-scoped
+    - customer-permits-read-hr-scoped
     - moderator-permits-all-hr-scoped
     - member-permits-read-hr-scoped
     - user-permits-all-owned
@@ -122,6 +126,7 @@
   rules:
     - administrator-permits-all-hr-scoped
     - sales-permits-read-hr-scoped
+    - customer-permits-read-hr-scoped
     - permit-read-strict-scoped
     - domainless-unauthenticated-permits-read-system
     - fallback-deny-all
@@ -148,6 +153,8 @@
         value: urn:restorecommerce:acs:model:currency.Currency
   rules:
     - administrator-permits-all-hr-scoped
+    - sales-permits-read-hr-scoped
+    - customer-permits-read-hr-scoped
     - permit-read-strict-scoped
     - domainless-unauthenticated-permits-read-system
     - fallback-deny-all
@@ -178,6 +185,7 @@
     - moderator-permits-all-hr-scoped
     - member-permits-read-hr-scoped
     - user-permits-all-owned
+    - customer-permits-read-owned
     - unauthenticated-user-permits-read-owned
     - fallback-deny-all
   meta:
@@ -334,6 +342,7 @@
   rules:
     - administrator-permits-all-hr-scoped
     - sales-permits-read-hr-scoped
+    - customer-permits-read-hr-scoped
     - permit-read-strict-scoped
     - domainless-unauthenticated-permits-read-system
     - fallback-deny-all

diff --git a/datasets/system/data/seed-data/rules.yaml b/datasets/system/data/seed-data/rules.yaml
@@ -270,6 +270,32 @@
         attributes:
           - id: urn:restorecommerce:acs:names:ownerInstance
             value: system
+---
+  id: customer-permits-read-owned
+  name: Customer Permits Read Owned
+  description: Permits read if subject is owner of resource
+  target:
+    resources: [ ]
+    subjects:
+      - id: urn:restorecommerce:acs:names:role
+        value: customer-r-id
+      - id: urn:restorecommerce:acs:names:roleScopingEntity
+        value: urn:restorecommerce:acs:model:user.User
+      - id: urn:restorecommerce:acs:names:hierarchicalRoleScoping
+        value: "false"
+    actions:
+      - id: urn:oasis:names:tc:xacml:1.0:action:action-id
+        value: urn:restorecommerce:acs:names:action:read
+  effect: PERMIT
+  evaluationCacheable: false
+  meta:
+    modifiedBy: ""
+    owners:
+      - id: urn:restorecommerce:acs:names:ownerIndicatoryEntity
+        value: urn:restorecommerce:acs:model:organization.Organization
+        attributes:
+          - id: urn:restorecommerce:acs:names:ownerInstance
+            value: system
 ---
   id: user-permits-all-owned
   name: User Permits All Owned