upstream-corteza/server/system/automation/rbac_handler.yaml

imports:
  - github.com/cortezaproject/corteza/server/system/types
  - github.com/cortezaproject/corteza/server/pkg/rbac

params:
  roleLookup: &roleLookup
    meta: { label: Role }
    required: true
    types:
      - { wf: ID,     }
      - { wf: Handle, }
      - { wf: Role,   suffix: res }

  manageParams: &manageParams
    resource:
      meta: { label: Resource }
      required: true
      types:
        # Note that we can not accept string here because
        # we need whole resource with all the info loaded
        - { wf: RbacResource }
    role: *roleLookup
    operation:
      meta: { label: Operation }
      required: true
      types:
        - { wf: String }

labels: &labels
  users:  "rbac"

functions:
  allow:
    meta:
      short: 'RBAC: Allow operation on resource to a role'
    labels:
      <<: *labels
    params: *manageParams

  deny:
    meta:
      short: 'RBAC: Deny operation on resource to a role'
    labels:
      <<: *labels
    params: *manageParams

  inherit:
    meta:
      short: 'RBAC: Remove allow/deny operation of a role from resource'
    labels:
      <<: *labels
    params: *manageParams

  check:
    meta:
      short: 'RBAC: Can user perform an operation on a resource'
    labels:
      <<: *labels
    params:
      resource:
        meta: { label: Resource }
        required: true
        types: [ { wf: RbacResource } ]
      operation:
        meta: { label: Operation }
        required: true
        types: [ { wf: String } ]
      user:
        meta: { label: User }
        types: [ { wf: User } ]
    results:
      can: { wf: Boolean }