<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2017 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->
<role oid="408be7b4-e502-11e5-9cd2-3c970e44b9e2"
        xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
        xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
>
    <name>Customer End User Role</name>
    <description>End user role for normal users.</description>
    <!-- ***** GUI ***** -->

    <!-- ***** From End User role (fragments) ***** -->

    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfDashboard</action>
    </authorization>
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfProfile</action>
    </authorization>
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfCredentials</action>
    </authorization>
    <!-- ***** MODEL ***** -->
    <authorization>
        <name>self-read</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <special>self</special>
        </object>
    </authorization>
    <authorization>
        <name>self-shadow-read</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>ShadowType</type>
            <owner>
                <special>self</special>
            </owner>
        </object>
    </authorization>
    <authorization>
        <name>self-credentials-request</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#changeCredentials</action>
        <phase>request</phase>
        <object>
            <special>self</special>
        </object>
        <item>credentials</item>
    </authorization>
    <authorization>
        <name>self-shadow-credentials-request</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#changeCredentials</action>
        <phase>request</phase>
        <object>
            <type>ShadowType</type>
            <owner>
                <special>self</special>
            </owner>
        </object>
        <item>credentials</item>
    </authorization>
    <!-- Intentionally commented out
        <authorization>
            <name>assign-requestable-roles</name>
            <description>
                Allow to assign requestable roles. This allows to request roles in a request-and-approve process.
                The requestable roles will be displayed in the role request dialog by default.
                Please note that the roles also need an approved definition to go through the approval process.
                Otherwise they will be assigned automatically wihout any approval.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#assign</action>
            <phase>request</phase>
            <object>
                <special>self</special>
            </object>
            <target>
                <type>RoleType</type>
                <filter>
                    <q:equal>
                        <q:path>requestable</q:path>
                        <q:value>true</q:value>
                    </q:equal>
                </filter>
            </target>
        </authorization>
    -->
    <authorization>
        <name>self-execution-modify</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
        <phase>execution</phase>
        <object>
            <special>self</special>
        </object>
        <item>credentials</item>
        <!-- Intentionally commented out
                <item>assignment</item>
                <item>parentOrgRef</item>
                <item>roleMembershipRef</item>
        -->
    </authorization>
    <authorization>
        <name>self-sahdow-execution-modify</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
        <phase>execution</phase>
        <object>
            <type>ShadowType</type>
            <owner>
                <special>self</special>
            </owner>
        </object>
        <item>credentials</item>
    </authorization>

    <!-- XXX Authorization to read own organization and its content including the path from root ... -->
    <authorization>
        <name>Magic read only</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <orgRelation>
                <scope>allDescendants</scope>
                <includeReferenceOrg>true</includeReferenceOrg>
            </orgRelation>
        </object>
    </authorization>

    <authorization>
        <name>Read for all resources and roles of subtype=customer and End User</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>ResourceType</type>
        </object>
        <object>
            <type>ServiceType</type>
        </object>
        <object>
            <type>RoleType</type>
            <filter>
                <q:text>subtype = "customer" or name = "End user"</q:text>
            </filter>
        </object>
    </authorization>
    <!-- Request a role will not work (fail) -->
    <!-- XXX XXX still roles can be "assigned" in GUI (will fail in model)-->
    <!-- https://jira.evolveum.com/browse/MID-2146 -->
    <authorization>
        <name>Do not allow to assign anything for self</name>
        <decision>deny</decision>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#assign</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#unassign</action>
        <phase>request</phase>
        <object>
            <type>RoleType</type>
        </object>
    </authorization>
    <requestable>false</requestable>
    <subtype>customer</subtype>
</role>
