permissions.acl

/*
* Dealer Rules:
* Dealer can see all cars, customers, orders and logistic companies
*/

rule allowDealerApproveOrder{
  description: "Dealer allow to approve order"
  participant: "com.iftakhar.dealership.Dealer"
  operation: ALL
  resource: "com.iftakhar.dealership.approveOrder"
  action: ALLOW
}

rule allowDealerViewAllOrder{
  description: "Dealer allow to see all order"
  participant: "com.iftakhar.dealership.Dealer"
  operation: ALL
  resource: "com.iftakhar.dealership.Order"
  action: ALLOW
}

rule allowDealerViewAllCars{
  description: "Dealer allow to see all cars"
  participant: "com.iftakhar.dealership.Dealer"
  operation: ALL
  resource: "com.iftakhar.dealership.Car"
  action: ALLOW
}

rule allowDealerViewThemselves{
  description: "Dealer allow to see themselves"
  participant(p): "com.iftakhar.dealership.Dealer"
  operation: ALL
  resource(r): "com.iftakhar.dealership.Dealer"
  condition: (p.getIdentifier()==r.getIdentifier())
  action: ALLOW
}

rule allowDealerViewAllCustomer{
  description: "Customer allow to see all customer"
  participant: "com.iftakhar.dealership.Dealer"
  operation: ALL
  resource: "com.iftakhar.dealership.Customer"
  action: ALLOW
}

rule allowDealerViewAllLogisticCompany{
  description: "Customer allow to see all logistic company"
  participant: "com.iftakhar.dealership.Dealer"
  operation: ALL
  resource: "com.iftakhar.dealership.LogisticCompany"
  action: ALLOW
}

/*
* Logistic companies rules:
* Dealer can see their shipment order and themselves
*/
rule logisticComViewTheirShipment{
  description: "Logistic companies allow to see only thier shipment"
  participant(p): "com.iftakhar.dealership.LogisticCompany"
  operation: READ,UPDATE
  resource(r): "com.iftakhar.dealership.Order"
  condition: (p.getIdentifier() == r.logisticCompany.getIdentifier())
  action: ALLOW
}

rule allowLogisticComDispatchOrder{
  description: "Allow logistic companies to dispatch assigned order"
  participant: "com.iftakhar.dealership.LogisticCompany"
  operation: ALL
  resource: "com.iftakhar.dealership.dispatchOrder"
  action: ALLOW
}

rule allowLogisticComDeliverOrder{
  description: "Logistic companies allow to deliver assigned order"
  participant: "com.iftakhar.dealership.LogisticCompany"
  operation: ALL
  resource: "com.iftakhar.dealership.deliverOrder"
  action: ALLOW
}

rule allowLogisticComToViewAssignedOrder{
  description: "Logistic companies allow to see only themselves"
  participant(p): "com.iftakhar.dealership.LogisticCompany"
  operation: READ
  resource(r): "com.iftakhar.dealership.Order"
  condition: (p.getIdentifier() == r.getIdentifier())
  action: ALLOW
}
rule allowLogisticComViewThemselves{
  description: "Logistic companies allow to see only themselves"
  participant(p): "com.iftakhar.dealership.LogisticCompany"
  operation: READ
  resource(r): "com.iftakhar.dealership.LogisticCompany"
  condition: (p.getIdentifier() == r.getIdentifier())
  action: ALLOW
}
/*
* Customer Rules:
* Customer can see all cars, their owned orders
*/
rule allowCustomerAllAvailableCars{
  description: "Customer allow to see only their own order"
  participant(p): "com.iftakhar.dealership.Customer"
  operation: READ, UPDATE
  resource(r): "com.iftakhar.dealership.Car"
  condition: (r.orderState == "CAR_AVAILABLE" || (r.orderState == "CAR_SOLD" && r.customer.customerId == p.customerId))
  action: ALLOW
}

rule allowCustomerViewOwnOrder{
  description: "Customer allow to see only their own order"
  participant(p): "com.iftakhar.dealership.Customer"
  operation: READ
  resource(r): "com.iftakhar.dealership.Order"
  condition: (p.getIdentifier() == r.customer.getIdentifier())
  action: ALLOW
}

rule allowCustomerViewThemselves{
  description: "Customer allow to see only their own order"
  participant(p): "com.iftakhar.dealership.Customer"
  operation: READ
  resource(r): "com.iftakhar.dealership.Customer"
  condition: (p.getIdentifier() == r.getIdentifier())
  action: ALLOW
}

rule allowCustomerBookCar{
  description: "Customer allow to book order"
  participant: "com.iftakhar.dealership.Customer"
  operation: CREATE
  resource: "com.iftakhar.dealership.bookCar"
  action: ALLOW
}

rule allowCustomerToViewCarBasedOnColor{
  description: "Customer allow to view car based on color"
  participant: "com.iftakhar.dealership.Customer"
  operation: CREATE
  resource: "com.iftakhar.dealership.selectCarBasedOnColor"
  action: ALLOW
}
rule allowCustomerToViewCarBasedOnPrice{
  description: "Customer allow to view car based on price"
  participant: "com.iftakhar.dealership.Customer"
  operation: CREATE
  resource: "com.iftakhar.dealership.selectCarBasedOnPrice"
  action: ALLOW
}
rule allowCustomerToViewCarBasedOnHorsePower{
  description: "Customer allow to view car based on horse power"
  participant: "com.iftakhar.dealership.Customer"
  operation: CREATE
  resource: "com.iftakhar.dealership.selectCarBasedHorsePower"
  action: ALLOW
}
rule allowCustomerToViewCarBasedOnModel{
  description: "Customer allow to view car based on model"
  participant: "com.iftakhar.dealership.Customer"
  operation: CREATE
  resource: "com.iftakhar.dealership.selectCarBasedOnModel"
  action: ALLOW
}
rule allowCustomerToViewCarBasedOnMake{
  description: "Customer allow to view car based on make"
  participant: "com.iftakhar.dealership.Customer"
  operation: CREATE
  resource: "com.iftakhar.dealership.selectCarBasedOnMake"
  action: ALLOW
}
rule customerAllowTCreateOrder{
  description: "Customer allow to book order"
  participant: "com.iftakhar.dealership.Customer"
  operation: CREATE
  resource: "com.iftakhar.dealership.Order"
  action: ALLOW
}

rule customerAllowToCancelOrder{
  description: "Customer allow to cancel order"
  participant: "com.iftakhar.dealership.Customer"
  operation: CREATE
  resource: "com.iftakhar.dealership.cancelOrder"
  action: ALLOW
}

/*
* System Rules:
* DO NOT TOUCH
*/

rule SystemACL {
    description: "System ACL to permit all access"
    participant: "org.hyperledger.composer.system.Participant"
    operation: ALL
    resource: "org.hyperledger.composer.system.**"
    action: ALLOW
}
rule NetworkAdminUser {
    description: "Grant business network administrators full access to user resources"
    participant: "org.hyperledger.composer.system.NetworkAdmin"
    operation: ALL
    resource: "**"
    action: ALLOW
}

rule NetworkAdminSystem {
    description: "Grant business network administrators full access to system resources"
    participant: "org.hyperledger.composer.system.NetworkAdmin"
    operation: ALL
    resource: "org.hyperledger.composer.system.**"
    action: ALLOW
}