Skip to content

Commit df5b921

Browse files
elf-pavlikelf-pavlik
committed
add Role to the spec
1 parent daf93b0 commit df5b921

8 files changed

Lines changed: 167 additions & 11 deletions

File tree

‎proposals/specification/access-authorizations.bs‎

Lines changed: 43 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -152,13 +152,13 @@ needs to change, it should be replaced.
152152
</tr>
153153
<tr>
154154
<td>dataOwner</td>
155-
<td>[SocialAgent](#classSocialAgent)</td>
156-
<td>[=Social Agent=] that owns the data being authorized</td>
155+
<td>[SocialAgent](#classSocialAgent) | [Role](#classRole)</td>
156+
<td>[=Social Agent=] or [=Role=] that owns the data being authorized</td>
157157
</tr>
158158
<tr>
159159
<td>grantee</td>
160-
<td>[Agent](#classAgent)</td>
161-
<td>The [=Social Agent=] or [=Application=] that has received
160+
<td>[Agent](#classAgent) | [Role](#classRole)</td>
161+
<td>The [=Agent=] or [=Role=] that has received
162162
authorization</td>
163163
</tr>
164164
<tr>
@@ -540,6 +540,12 @@ inherited permissions.
540540
<td><b>No</b></td>
541541
<td>All of the owner's data of a specified type, and all data shared with the owner of that type, across the owner's registries</td>
542542
</tr>
543+
<tr>
544+
<td><a href="#scope-fromrole"><b>`AllFromRole`</b></a></td>
545+
<td>Yes</td>
546+
<td><b>No</b></td>
547+
<td>All data of a given type shared by a specified [=Role=] with the owner, across all that [=Role's=] member [=Social Agents'=] registries</td>
548+
</tr>
543549
<tr>
544550
<td><a href="#scope-fromagent"><b>`AllFromAgent`</b></a></td>
545551
<td>Yes</td>
@@ -639,6 +645,39 @@ for each unique [=Data Registry=], including Bob's.
639645
</pre>
640646
</figure>
641647

648+
### <code>AllFromRole</code> ### {#scope-fromrole}
649+
650+
The `interop:AllFromRole` [=access scope=] includes all data of a given type
651+
owned and shared by all [=Social Agent=] member of a specified [=Role=], across all of their
652+
[=Data Registries=]. Essentially, Alice can use this scope to delegate
653+
any access that she has been given by another [=Social Agent's=]
654+
data (e.g. Bob) whose in that [=Role=], to another [=Agent=] of her choosing.
655+
656+
The [=Role=] whose all [=Social Agent=] member access is being shared is identified via
657+
`interop:dataOwner`.
658+
659+
<b>Shapes:</b> [DataAuthorizationAllFromRoleShape](interop.shex#DataAuthorizationAllFromRoleShape)
660+
661+
The following example illustrates *Alice's* authorization to give Performchart access to
662+
data of type `pm-shapetrees:ProjectTree` with a scope of `interop:AllFromRole`
663+
and an `interop:dataOwner` of a *Role*.
664+
665+
Note: While Bob, as a member of the Role, has granted Alice the ability to manipulate
666+
his project data, Alice grants Performchart a narrower scope of read-only access.
667+
668+
<figure>
669+
<figcaption>Alice's [=Data Authorization=] for Performchart to access Projects
670+
shared by members of a [=Role=] at https://alice.example/authorization/a1b2c3d4 -
671+
<a href="snippets/alice.example/a1b2c3d4.ttl">View</a>
672+
</figcaption>
673+
<pre class=include-code>
674+
path: snippets/alice.example/a1b2c3d4.ttl
675+
highlight: turtle
676+
show: 14-25
677+
line-highlight: 21
678+
</pre>
679+
</figure>
680+
642681
### <code>AllFromAgent</code> ### {#scope-fromagent}
643682

644683
The `interop:AllFromAgent` [=access scope=] includes all data of a given type

‎proposals/specification/index.bs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ Inline Github Issues: title
1313
Editor: Justin Bingham
1414
Editor: Eric Prud'hommeaux
1515
Editor: elf Pavlik
16-
!Version: 0.1
16+
!Version: 0.2
1717
Markup Shorthands: markdown yes
1818
Boilerplate: conformance no
1919
Dark Mode: off
@@ -198,6 +198,7 @@ em.rfc2119 {
198198
<pre class=include>path: agent.bs</pre>
199199
<pre class=include>path: social-agent.bs</pre>
200200
<pre class=include>path: application.bs</pre>
201+
<pre class=include>path: role.bs</pre>
201202
<pre class=include>path: agent-registrations.bs</pre>
202203
<pre class=include>path: data-registrations.bs</pre>
203204
<pre class=include>path: data-authorization.bs</pre>

‎proposals/specification/role.bs‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
Roles {#role}
2+
=====================
3+
4+
A <dfn>Role</dfn> is a collection of [=Social Agents=],
5+
internal to the context of the [=Social Agent=] defining the Role.
6+
7+
<table class="classinfo data" align="left" id="classRole">
8+
<colgroup></colgroup>
9+
<colgroup></colgroup>
10+
<colgroup></colgroup>
11+
<thead>
12+
<tr>
13+
<th>Property</th>
14+
<th>Range</th>
15+
<th>Description</th>
16+
</tr>
17+
</thead>
18+
<tbody>
19+
<tr>
20+
<td>hasMember</td>
21+
<td>[SocialAgent](#classSocialAgent)</td>
22+
<td>[=Social Agent=] assigned as a member to the [=Role=]</td>
23+
</tr>
24+
</tbody>
25+
</table>
26+
27+
<figure>
28+
<figcaption>[=Role=] with member Bob at https://alice.example/roles/a7c349e2 -
29+
<a href="snippets/alice.example/a7c349e2.ttl">View</a>
30+
</figcaption>
31+
<pre class=include-code>
32+
path: snippets/alice.example/a7c349e2.ttl
33+
highlight: turtle
34+
</pre>
35+
</figure>
36+
37+
When [=Authorization Agent=] generates [=Data Grants=] from a [=Data Authorization=]
38+
* if a [=Role=] is used as `dataOwner` it MUST generate a [=Data Grant=] for each member of that [=Role=] as `dataOwner`.
39+
* if a [=Role=] is used as `grantee` it MUST generate a [=Data Grant=] for each member of that [=Role=] as `grantee`.
40+
* if a [=Role=] is used as both `dataOwner` and `grantee` it MUST generate a [=Data Grant=] for the cartesian product of the two [=Roles=], with each member as corresponding `dataOwner` or `grantee`.
41+
42+
## Role Registry ## {#datamodel-role-registry}
43+
44+
A <dfn>Role Registry</dfn> contains all the [=Roles=] defined by the [=Social Agent=] who owns the [=Role Registry=]
45+
46+
<table class="classinfo data" align="left" id="classRoleRegistry">
47+
<colgroup></colgroup>
48+
<colgroup></colgroup>
49+
<colgroup></colgroup>
50+
<thead>
51+
<tr>
52+
<th>Property</th>
53+
<th>Range</th>
54+
<th>Description</th>
55+
</tr>
56+
</thead>
57+
<tbody>
58+
<tr>
59+
<td>ldp:contains</td>
60+
<td>[Role](#classRole)</td>
61+
<td>[=Role=] in the [=Role Registry=]</td>
62+
</tr>
63+
</tbody>
64+
</table>
65+
66+
<figure>
67+
<figcaption>[=Role Registry=] at https://alice.example/roles/ -
68+
<a href="snippets/alice.example/roles-registry.ttl">View</a>
69+
</figcaption>
70+
<pre class=include-code>
71+
path: snippets/alice.example/roles-registry.ttl
72+
highlight: turtle
73+
</pre>
74+
</figure>

‎proposals/specification/snippets/alice.example/a1b2c3d4.ttl‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
PREFIX rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#>
2+
PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
3+
PREFIX xsd: <http://www.w3.org/2001/XMLSchema#>
4+
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
5+
PREFIX interop: <http://www.w3.org/ns/solid/interop#>
6+
PREFIX alice: <https://alice.example/>
7+
PREFIX bob: <https://bob.example>
8+
PREFIX performchart: <https://performchart.example/>
9+
PREFIX alice-authorization: <https://alice.example/authorization/>
10+
PREFIX alice-agents: <https://alice.example/agents/>
11+
PREFIX alice-work-data: <https://work.alice.example>
12+
PREFIX pm-shapetrees: <http://data.example/shapetrees/pm#>
13+
14+
alice-authorization:a1b2c3d4
15+
a interop:DataAuthorization ;
16+
interop:grantedBy alice:\#id ;
17+
interop:dataOwner alice:roles\/a7c349e2 ;
18+
interop:grantee performchart:\#id ;
19+
interop:registeredShapeTree pm-shapetrees:ProjectTree ;
20+
interop:accessMode acl:Read ;
21+
interop:scopeOfAuthorization interop:AllFromRole ;
22+
interop:satisfiesAccessNeed performchart:\#ac54ff1e .

‎proposals/specification/snippets/alice.example/a7c349e2.ttl‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
PREFIX interop: <http://www.w3.org/ns/solid/interop#>
2+
PREFIX alice: <https://alice.example/>
3+
PREFIX bob: <https://bob.example>
4+
5+
alice:roles\/a7c349e2
6+
a interop:Role ;
7+
interop:hasMember bob:\#id .

‎proposals/specification/snippets/alice.example/registries.ttl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ PREFIX alice-personal: <https://personal.alice.example/>
66
alice:registries
77
a interop:RegistrySet;
88
interop:hasAgentRegistry alice:agents\/ ;
9+
interop:hasRoleRegistry alice:roles\/ ;
910
interop:hasAuthorizationRegistry alice:authorization\/ ;
1011
interop:hasDataRegistry
1112
alice-work:data\/ ,

‎proposals/specification/snippets/alice.example/roles-registry.ttl‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
PREFIX interop: <http://www.w3.org/ns/solid/interop#>
2+
PREFIX ldp: <http://www.w3.org/ns/ldp#>
3+
PREFIX alice: <https://alice.example/>
4+
5+
alice:roles\/
6+
a interop:RoleRegistry, ldp:BasicContainer ;
7+
ldp:contains alice:roles\/a7c349e2 .

‎proposals/specification/social-agent.bs‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,8 @@ which must be a separate resource from the [=identity profile document=]
1616
that the [=Social Agent=] graph resides in so that it can be given more
1717
restrictive (i.e. non-public) permissions.
1818

19-
The [=identity profile document=] <em class="rfc2119">MUST</em>
20-
be readable by the public. It <em class="rfc2119">MAY</em>
19+
The [=identity profile document=] <em class="rfc2119">MUST</em>
20+
be readable by the public. It <em class="rfc2119">MAY</em>
2121
use any resource or subject names.
2222

2323
[Class Definition](interop.ttl#SocialAgent) -
@@ -52,11 +52,11 @@ use any resource or subject names.
5252
<figure>
5353
<figcaption>[=Social Agent=] at https://alice.example/#id -
5454
<a href="snippets/alice.example/alice.example.ttl">View</a>
55-
</figcaption>
55+
</figcaption>
5656
<pre class=include-code>
5757
path: snippets/alice.example/alice.example.ttl
5858
highlight: turtle
59-
</pre>
59+
</pre>
6060
</figure>
6161

6262
## Registry Set ## {#datamodel-registry-set}
@@ -94,6 +94,11 @@ authorized [=Applications=].
9494
<td>[AgentRegistry](#classAgentRegistry)</td>
9595
<td>[=Agent Registry=] for the [=Social Agent=]</td>
9696
</tr>
97+
<tr>
98+
<td>hasRoleRegistry</td>
99+
<td>[RoleRegistry](#classRoleRegistry)</td>
100+
<td>[=Role Registry=] for the [=Social Agent=]</td>
101+
</tr>
97102
<tr>
98103
<td>hasAuthorizationRegistry</td>
99104
<td>[AuthorizationRegistry](#classAuthorizationRegistry)</td>
@@ -110,9 +115,9 @@ authorized [=Applications=].
110115
<figure>
111116
<figcaption>[=Registry Set=] at https://alice.example/registries -
112117
<a href="snippets/alice.example/registries.ttl">View</a>
113-
</figcaption>
118+
</figcaption>
114119
<pre class=include-code>
115120
path: snippets/alice.example/registries.ttl
116121
highlight: turtle
117-
</pre>
122+
</pre>
118123
</figure>

0 commit comments

Comments
 (0)