<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2010-2019 Evolveum and contributors
  ~
  ~ This work is dual-licensed under the Apache License 2.0
  ~ and European Union Public License. See LICENSE file for details.
  -->
<role oid="00000000-0000-0000-0000-00000000000b"
      xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3">
    <name>Reviewer</name>
    <description>Role authorizing users to make decisions on certification cases.</description>
    <assignment id="1">
        <identifier>archetype</identifier>
        <targetRef oid="00000000-0000-0000-0000-000000000320" type="ArchetypeType"/> <!-- System role -->
    </assignment>
    <authorization id="2">
        <name>gui-reviewer-access</name>
        <description>
            Allow access to list of certification cases in GUI. Allow access to pages that show object details,
            so the reviewer may examine data related to the request.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#myActiveCertificationCampaigns</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#myCertificationDecisions</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#userDetails</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#roleDetails</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgUnit</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#service</action>
    </authorization>
    <authorization id="3">
        <name>read-and-make-decisions</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#readOwnCertificationDecisions</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#recordCertificationDecision</action>
    </authorization>
    <authorization id="4">
        <name>users-read</name>
        <description>
            Allow to read basic user properties.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="8">
            <type>UserType</type>
        </object>
        <item>name</item>
        <item>givenName</item>
        <item>familyName</item>
        <item>fullName</item>
        <item>employeeType</item>
        <item>employeeNumber</item>
    </authorization>
    <authorization id="5">
        <name>roles-read</name>
        <description>
            Allow to read basic role properties.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="9">
            <type>RoleType</type>
        </object>
        <item>name</item>
        <item>displayName</item>
        <item>identifier</item>
        <item>description</item>
        <item>riskLevel</item>
        <item>roleType</item>
    </authorization>
    <authorization id="6">
        <name>orgs-read</name>
        <description>
            Allow to read basic org properties.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="10">
            <type>OrgType</type>
        </object>
        <item>name</item>
        <item>displayName</item>
        <item>identifier</item>
        <item>description</item>
        <item>riskLevel</item>
        <item>orgType</item>
    </authorization>
    <authorization id="7">
        <name>services-read</name>
        <description>
            Allow to read basic service properties.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="11">
            <type>ServiceType</type>
        </object>
        <item>name</item>
        <item>displayName</item>
        <item>identifier</item>
        <item>description</item>
        <item>riskLevel</item>
        <item>serviceType</item>
    </authorization>
  <authorization id="37">
        <name>services-read</name>
        <description>
            Allow to read basic role properties.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="11">
            <type>RoleType</type>
        </object>
    </authorization>
    <authorization>
        <name>certification-campaign-read</name>
        <description>
            Allow to read stageNumber property of certification campaign.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>AccessCertificationCampaignType</type>
        </object>
        <item>name</item>
        <item>stageNumber</item>
        <item>state</item>
        <item>iteration</item>
        <item>startTimestamp</item>
    </authorization>
</role>
