<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2017-2019 Evolveum and contributors
  ~
  ~ Licensed under the EUPL-1.2 or later.
  -->

<role oid="00000000-0000-0000-0000-00000000000a"
      xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
    <name>Approver</name>
    <description>Role authorizing users to make approval decisions on work items.</description>
    <assignment id="1">
        <identifier>archetype</identifier>
        <targetRef oid="00000000-0000-0000-0000-000000000320" type="ArchetypeType"/> <!-- System role -->
    </assignment>
    <authorization id="2">
        <name>gui-approver-access</name>
        <description>
            Allow access to list of work items in GUI. Allow access to pages that show object details,
            so the approver may examine who is requesting and what is requesting.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#workItem</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#myWorkItems</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#claimableWorkItems</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#userDetails</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#roleDetails</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgDetails</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#serviceDetails</action>
    </authorization>
    <authorization id="3">
        <name>own-workitems-read-complete-delegate</name>
        <description>
            Allows reading, completion, and delegation of own work items.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#completeWorkItem</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delegateWorkItem</action>
        <object>
            <parent>
                <type>CaseType</type>
                <path>workItem</path>
            </parent>
            <assignee>
                <special>self</special>
            </assignee>
        </object>
    </authorization>
    <authorization id="4">
        <name>cases-read</name>
        <description>
            Allow to see the requester of the operation that is being approved and the current delta.
            In order for the approver to see other properties (e.g. history of the approvals) please allow read access
            to other items as well.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="9">
            <type>CaseType</type>
        </object>
        <item>name</item>
        <item>archetypeRef</item>
        <item>metadata</item>
        <item>parentRef</item>
        <item>requestorRef</item>
        <item>objectRef</item>
        <item>targetRef</item>
        <item>state</item>
        <item>stageNumber</item>
        <item>approvalContext</item>
        <item>modelContext</item>
        <item>manualProvisioningContext</item>
    </authorization>
    <authorization id="5">
        <name>users-read</name>
        <description>
            Allow to read basic user properties to be able to display requestor details in the
            approval forms.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="10">
            <type>UserType</type>
        </object>
        <item>name</item>
        <item>givenName</item>
        <item>familyName</item>
        <item>fullName</item>
        <item>employeeType</item>
        <item>employeeNumber</item>
    </authorization>
    <authorization id="6">
        <name>roles-read</name>
        <description>
            Allow to read basic role properties to be able to display details of the requested role.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="11">
            <type>RoleType</type>
        </object>
        <item>name</item>
        <item>displayName</item>
        <item>identifier</item>
        <item>description</item>
        <item>riskLevel</item>
        <item>roleType</item>
    </authorization>
    <authorization id="7">
        <name>orgs-read</name>
        <description>
            Allow to read basic org properties to be able to display details of the requested org.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="12">
            <type>OrgType</type>
        </object>
        <item>name</item>
        <item>displayName</item>
        <item>identifier</item>
        <item>description</item>
        <item>riskLevel</item>
        <item>orgType</item>
    </authorization>
    <authorization id="8">
        <name>services-read</name>
        <description>
            Allow to read basic service properties to be able to display details of the requested service.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="13">
            <type>ServiceType</type>
        </object>
        <item>name</item>
        <item>displayName</item>
        <item>identifier</item>
        <item>description</item>
        <item>riskLevel</item>
        <item>serviceType</item>
    </authorization>
</role>
