core/fga/model/automation/assessments.fga at b435e0c6bfc3323e0780010a5d58b76ac104a6e9 · theopenlane/core · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
module automation

# templates (this encompasses things like questionnaires or jsonschemas) and permissions are granted
# based on the the organization level access or parent objects such as trust centers.
type template
  relations
    # base permissions - these should all be derived permissions except public tuples
    define can_view: [user:*, service:*] or (viewer but not blocked)
    define can_edit: (editor but not blocked) or can_delete
    define can_delete: (editor but not blocked)

    # tuple based permissions for edit, view, blocked, and audit log viewing
    define editor: [user, service, group#member] or parent_editor
    define viewer: [user, service, group#member] or editor or parent_viewer
    define blocked: [user, service, group#member]
    define audit_log_viewer: (([user, service, group#member] or audit_log_viewer from parent or audit_log_viewer from parent_context) and can_view) or can_view

    # parent permissions derived based on `crud` permissions or parents
    define parent_editor: can_edit from parent_context or can_edit_template from parent_context or can_edit from parent
    define parent_viewer: can_view from parent_context or can_view_template from parent_context or can_view from parent
    define parent_context: [organization]
    define parent: [trust_center]

# document_data is the json data that is associated to a template
# access to the document_data is inherited from the template
type document_data
  relations
    # base permissions - these should all be derived permissions
    define can_view: (viewer but not blocked)
    define can_edit: (editor but not blocked) or can_delete
    define can_delete: (editor but not blocked)

    # tuple based permissions for edit, view, blocked, and audit log viewing
    define editor: [user, service, group#member] or parent_editor
    define viewer: [user, service, group#member] or editor or parent_viewer
    define blocked: [user, service, group#member]
    define audit_log_viewer: ([user, service, group#member] or audit_log_viewer from parent) and can_view

    # parent permissions derived based on `crud` permissions or parents
    define parent_editor: can_edit from parent
    define parent_viewer: can_view from parent
    define parent: [template, user]

# assessments are viewable by organization admin+, by can_edit_assessment, or inherited from the parent objects such as campaigns. They are not viewable by org members (view only) access by default
type assessment
  relations
    # base permissions - these should all be derived permissions
    define can_view: [user:*, service:*] or (viewer but not blocked)
    define can_edit: (editor but not blocked) or can_delete
    define can_delete: (editor but not blocked)

    # tuple based permissions for edit, view, blocked, and audit log viewing
    define editor: [user, service, group#member] or parent_editor or owner or delegate
    define viewer: [user, service, group#member] or editor or parent_viewer
    define blocked: [user, service, group#member]
    define audit_log_viewer: ([user, service, group#member] or audit_log_viewer from parent_context or audit_log_viewer from parent) and can_view

    define owner: [user, group#member]
    define delegate: [user, group#member]

    # parent permissions derived based on `crud` permissions or parents
    define parent_editor: can_edit from parent_context or can_edit_assessment from parent_context or can_edit from parent
    define parent_viewer: can_view_assessment from parent_context or can_view from parent
    define parent_context: [organization]
    define parent: [campaign]

# assessment_response permissions is exclusively based on the parents, it is not inherited from the organization to prevent
# users that should not have access to responses from seeing all responses
type assessment_response
  relations
    # base permissions - these should all be derived permissions
    define can_view: (viewer but not blocked)
    define can_edit: (editor but not blocked) or can_delete
    define can_delete: parent_editor # response owners cannot delete

    # tuple based permissions for edit, view, blocked, and audit log viewing
    define editor: [user, service, group#member] or parent_editor or response_owner
    define viewer: [user, service, group#member] or editor or parent_viewer
    define blocked: [user, service, group#member]
    define audit_log_viewer: ([user, service, group#member] or audit_log_viewer from parent) and can_view

    # the user who filled out the assessment response - they can view their own response
    define response_owner: [user]

    # parent permissions derived based on `crud` permissions or parents
    define parent_editor: can_edit from parent
    define parent_viewer: can_view from parent
    define parent: [assessment, campaign, entity]

# campaign, similar to assessments, are viewable by organization admin+, by can_edit_campaign or inherited from the parent objects such as campaigns. They are not viewable by org members (view only) access by default
type campaign
  relations
    # base permissions - these should all be derived permissions
    define can_view: (viewer but not blocked)
    define can_edit: (editor but not blocked) or can_delete
    define can_delete: (editor but not blocked)

    # tuple based permissions for edit, view, blocked, and audit log viewing
    define editor: [user, service, group#member] or parent_editor
    define viewer: [user, service, group#member] or editor or parent_viewer
    define blocked: [user, service, group#member]
    define audit_log_viewer: (([user, service, group#member] or audit_log_viewer from parent_context) and can_view) or can_view

    # parent permissions derived based on `crud` permissions or parents
    define parent_editor: can_edit from parent_context or can_edit_campaign from parent_context
    define parent_viewer:  can_view_campaign from parent_context
    define parent_context: [organization]

# campaign targets permission are based on their parent campaign
type campaign_target
  relations
    # base permissions - these should all be derived permissions
    define can_view: (viewer but not blocked)
    define can_edit: (editor but not blocked) or can_delete
    define can_delete: (editor but not blocked)

    # tuple based permissions for edit, view, blocked, and audit log viewing
    define editor: [user, service, group#member] or parent_editor
    define viewer: [user, service, group#member] or editor or parent_viewer
    define blocked: [user, service, group#member]
    define audit_log_viewer: ([user, service, group#member] or audit_log_viewer from parent) and can_view

    # parent permissions derived based on `crud` permissions or parents
    define parent_editor: can_edit from parent
    define parent_viewer: can_view from parent
    define parent: [campaign]