felix.ruizdearcaute/app-organization-portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #599 from lblod/DL-6575-sparql-parser

Browse Source 
DL-6575: added sparql-parser + edit changelog
This commit is contained in:
Damon Kennes
2026-04-24 10:12:57 +02:00
committed by GitHub
parent 71d6ee5ed4 b9654a33db
commit 008b382ddc
5 changed files with 376 additions and 320 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
CHANGELOG.md
View File

@@ -7,11 +7,12 @@
- Add column to query organizations in Dashboard [OP-3758]
- Query list change events of organisations in Dashboard [OP-3760]
- Disable SPARQL endpoint
- sparql-parser [DL-6575]
### Deploy notes
```
drc pull kbo-data-sync && drc up -d kbo-data-sync
drc restart report-generation
drc pull kbo-data-sync db resource && drc up -d kbo-data-sync db resource
drc restart report-generation
drc restart migrations && drc logs -ft --tail=200 migrations
drc up -d delta-producer-publication-graph-maintainer
drc restart dispatcher

311
config/authorization/config.ex
View File

@@ -1,311 +0,0 @@
alias Acl.Accessibility.Always, as: AlwaysAccessible
alias Acl.GraphSpec.Constraint.Resource, as: ResourceConstraint
alias Acl.GraphSpec.Constraint.ResourceFormat, as: ResourceFormatConstraint
alias Acl.Accessibility.ByQuery, as: AccessByQuery
alias Acl.GraphSpec, as: GraphSpec
alias Acl.GroupSpec, as: GroupSpec
alias Acl.GroupSpec.GraphCleanup, as: GraphCleanup
defmodule Acl.UserGroups.Config do
@error_type [
"https://docs.oasis-open-projects.org/oslc-op/core/v3.0/os/core-vocab.html#Error"
]
@worship_type [
"http://data.lblod.info/vocabularies/erediensten/EredienstMandataris",
"http://data.lblod.info/vocabularies/erediensten/BestuurVanDeEredienst",
"http://data.lblod.info/vocabularies/erediensten/EredienstBestuurseenheid",
"http://data.lblod.info/vocabularies/erediensten/RolBedienaar",
"http://data.lblod.info/vocabularies/erediensten/VoorwaardenBedienaar",
"http://data.lblod.info/vocabularies/erediensten/PositieBedienaar",
"http://data.lblod.info/vocabularies/erediensten/BetrokkenLokaleBesturen",
"http://data.lblod.info/vocabularies/erediensten/VerbondenJuridischeStructuren",
"http://data.lblod.info/vocabularies/erediensten/CentraalBestuurVanDeEredienst",
"http://data.lblod.info/vocabularies/erediensten/RepresentatiefOrgaan"
]
@public_type [
"http://www.w3.org/ns/org#Role",
"http://data.vlaanderen.be/ns/besluit#Bestuurseenheid",
"http://xmlns.com/foaf/0.1/Person",
"http://xmlns.com/foaf/0.1/OnlineAccount",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject",
"http://www.w3.org/ns/dcat#Dataset",
"http://www.w3.org/ns/dcat#Distribution",
"http://www.w3.org/ns/dcat#Catalog",
"http://mu.semte.ch/vocabularies/ext/GeslachtCode",
"http://data.lblod.info/vocabularies/leidinggevenden/FunctionarisStatusCode",
"http://lblod.data.gift/vocabularies/organisatie/OrganisatieStatusCode",
"http://lblod.data.gift/vocabularies/organisatie/BestuursfunctieCode",
"http://lblod.data.gift/vocabularies/organisatie/BestuursorgaanClassificatieCode",
"http://lblod.data.gift/vocabularies/organisatie/MandatarisStatusCode",
"http://lblod.data.gift/vocabularies/organisatie/BestuurseenheidClassificatieCode",
"http://mu.semte.ch/vocabularies/ext/GeregistreerdeOrganisatieClassificatieCode",
"http://lblod.data.gift/vocabularies/organisatie/TypeEredienst",
"http://www.w3.org/2004/02/skos/core#ConceptScheme",
"http://lblod.data.gift/vocabularies/organisatie/BedienaarFinancieringCode",
"http://www.w3.org/2004/02/skos/core#Concept",
"http://publications.europa.eu/ontology/euvoc#Country",
"http://lblod.data.gift/vocabularies/organisatie/TypeVestiging",
"http://lblod.data.gift/vocabularies/organisatie/HelftVerkiezing",
"http://lblod.data.gift/vocabularies/organisatie/Veranderingsgebeurtenis",
"http://lblod.data.gift/vocabularies/organisatie/TypeBetrokkenheid",
"http://lblod.data.gift/vocabularies/organisatie/VoorwaardenBedienaarCriterium",
"http://lblod.data.gift/vocabularies/organisatie/BedienaarCriteriumBewijsstuk",
"http://lblod.data.gift/vocabularies/organisatie/EredienstBeroepen",
"http://lblod.data.gift/vocabularies/organisatie/Rechtsvormtype",
"http://www.w3.org/ns/prov#Location"
]
@org_type [
"http://purl.org/dc/terms/Agent",
"http://www.w3.org/ns/org#Organization",
"http://www.w3.org/ns/regorg#RegisteredOrganization",
"http://data.vlaanderen.be/ns/besluit#Besluit",
"https://data.vlaanderen.be/ns/besluitvorming#Beslissingsactiviteit",
"http://www.w3.org/ns/org#Site",
"http://www.w3.org/ns/locn#Address",
"http://www.w3.org/ns/person#Person",
"http://schema.org/ContactPoint",
"http://data.vlaanderen.be/ns/besluit#Bestuurseenheid",
"http://data.vlaanderen.be/ns/besluit#Bestuursorgaan",
"http://www.w3.org/ns/adms#Identifier",
"https://data.vlaanderen.be/ns/generiek#GestructureerdeIdentificator",
"http://data.vlaanderen.be/ns/mandaat#Mandaat",
"http://data.vlaanderen.be/ns/mandaat#Mandataris",
"http://data.lblod.info/vocabularies/leidinggevenden/Functionaris",
"http://data.lblod.info/vocabularies/leidinggevenden/Bestuursfunctie",
"http://lblod.data.gift/vocabularies/organisatie/VeranderingsgebeurtenisResultaat",
"http://www.w3.org/ns/org#Post",
"http://www.w3.org/ns/org#ChangeEvent",
"http://data.lblod.info/vocabularies/contacthub/AgentInPositie",
"http://mu.semte.ch/vocabularies/ext/KboOrganisatie",
"http://www.w3.org/ns/org#Membership",
"http://www.w3.org/2006/time#ProperInterval",
]
@shared_protected_type [
"http://xmlns.com/foaf/0.1/Image",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
]
@vendor_type [
"http://mu.semte.ch/vocabularies/ext/Vendor"
]
defp access_by_role(group_string) do
%AccessByQuery{
# vars: ["session_group","session_role"], todo we might have to create multiple graph depending on role
vars: [],
query: sparql_query_for_access_role(group_string)
}
end
defp sparql_query_for_access_role(group_string) do
"PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
SELECT distinct ?session_group ?session_role WHERE {
<SESSION_ID> ext:sessionGroup/mu:uuid ?session_group;
ext:activeSessionRole ?session_role.
FILTER( ?session_role = \"#{group_string}\" )
}"
end
defp can_access_dashboard() do
%AccessByQuery{
vars: [],
query: "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
SELECT DISTINCT ?session WHERE {
VALUES ?session { <SESSION_ID> }
?session ext:sessionRole \"LoketLB-AdminDashboardOrganisatiePortaalGebruiker\" .
}"
}
end
def user_groups do
[
%GroupSpec{
name: "acmidm-lezer",
useage: [:read],
access: access_by_role("ABBOrganisatiePortaalGebruiker-lezer"),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/administrative-unit",
constraint: %ResourceConstraint{
resource_types: @org_type
}
},
%GraphSpec{
graph: "http://mu.semte.ch/graphs/vendor-management-data",
constraint: %ResourceConstraint{
resource_types: @vendor_type
}
}
]
},
%GroupSpec{
name: "acmidm-editeerder",
useage: [:read, :write, :read_for_write],
access: access_by_role("ABBOrganisatiePortaalGebruiker-editeerder"),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/administrative-unit",
constraint: %ResourceConstraint{
resource_types: @org_type ++ @error_type
}
},
%GraphSpec{
graph: "http://mu.semte.ch/graphs/vendor-management-data",
constraint: %ResourceConstraint{
resource_types: @vendor_type
}
}
]
},
%GroupSpec{
name: "acmidm-beheerder",
useage: [:read, :write, :read_for_write],
access: access_by_role("ABBOrganisatiePortaalGebruiker-beheerder"),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/administrative-unit",
constraint: %ResourceConstraint{
resource_types: @org_type ++ @error_type
}
},
%GraphSpec{
graph: "http://mu.semte.ch/graphs/vendor-management-data",
constraint: %ResourceConstraint{
resource_types: @vendor_type
}
}
]
},
%GroupSpec{
name: "acmidm-worship-lezer",
useage: [:read],
access: access_by_role("ABBOrganisatiePortaalErediensten-lezer"),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/worship-service",
constraint: %ResourceConstraint{
resource_types: @org_type ++ @worship_type
}
},
%GraphSpec{
graph: "http://mu.semte.ch/graphs/vendor-management-data",
constraint: %ResourceConstraint{
resource_types: @vendor_type
}
}
]
},
%GroupSpec{
name: "acmidm-worship-editeerder",
useage: [:read, :write, :read_for_write],
access: access_by_role("ABBOrganisatiePortaalErediensten-editeerder"),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/worship-service",
constraint: %ResourceConstraint{
resource_types: @org_type ++ @error_type ++ @worship_type
}
},
%GraphSpec{
graph: "http://mu.semte.ch/graphs/vendor-management-data",
constraint: %ResourceConstraint{
resource_types: @vendor_type
}
}
]
},
%GroupSpec{
name: "acmidm-worship-beheerder",
useage: [:read, :write, :read_for_write],
access: access_by_role("ABBOrganisatiePortaalErediensten-beheerder"),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/worship-service",
constraint: %ResourceConstraint{
resource_types: @org_type ++ @error_type ++ @worship_type
}
},
%GraphSpec{
graph: "http://mu.semte.ch/graphs/vendor-management-data",
constraint: %ResourceConstraint{
resource_types: @vendor_type
}
}
]
},
%GroupSpec{
name: "public",
useage: [:read],
access: %AlwaysAccessible{},
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/public",
constraint: %ResourceConstraint{
resource_types: @public_type
}
},
%GraphSpec{
graph: "http://mu.semte.ch/graphs/shared",
constraint: %ResourceConstraint{
resource_types: @shared_protected_type ++ @org_type
}
}
]
},
# // Dashboard admin
%GroupSpec{
name: "o-admin-rwf",
useage: [:read, :write, :read_for_write],
access: can_access_dashboard(),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/reports",
constraint: %ResourceConstraint{
resource_types: [
"http://lblod.data.gift/vocabularies/reporting/Report",
"http://open-services.net/ns/core#Error",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#DataContainer",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
]
}
},
%GraphSpec{
graph: "http://mu.semte.ch/graphs/system/jobs",
constraint: %ResourceConstraint{
resource_types: [
"http://vocab.deri.ie/cogs#Job",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#DataContainer",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
]
}
},
# OP stores jobs in multiple graphs, so we configure both until they are merged into one graph
%GraphSpec{
graph: "http://mu.semte.ch/graphs/jobs",
constraint: %ResourceConstraint{
resource_types: [
"http://vocab.deri.ie/cogs#Job",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#DataContainer",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
]
}
}
]
},
# // CLEANUP
#
%GraphCleanup{
originating_graph: "http://mu.semte.ch/application",
useage: [:write],
name: "clean"
}
]
end
end

368
config/authorization/config.lisp Normal file
View File

@@ -0,0 +1,368 @@
;;;;;;;;;;;;;;;;;;;
;;; delta messenger
(in-package :delta-messenger)
(add-delta-logger)
(add-delta-messenger "http://deltanotifier/")
;;;;;;;;;;;;;;;;;
;;; configuration
(in-package :client)
(setf *log-sparql-query-roundtrip* t)
(setf *backend* "http://triplestore:8890/sparql")
(in-package :server)
(setf *log-incoming-requests-p* nil)
;;;;;;;;;;;;;;;;;
;;; access rights
(in-package :acl)
(defparameter *access-specifications* nil
"All known ACCESS specifications.")
(defparameter *graphs* nil
"All known GRAPH-SPECIFICATION instances.")
(defparameter *rights* nil
"All known GRANT instances connecting ACCESS-SPECIFICATION to GRAPH.")
;; Prefixes used in the constraints below (not in the SPARQL queries)
(define-prefixes
:org "http://www.w3.org/ns/org#"
:locn "http://www.w3.org/ns/locn#"
:schema "http://schema.org/"
:regorg "http://www.w3.org/ns/regorg#"
:person "http://www.w3.org/ns/person#"
:adms "http://www.w3.org/ns/adms#"
:prov "http://www.w3.org/ns/prov#"
:generiek "https://data.vlaanderen.be/ns/generiek#"
:mandaat "http://data.vlaanderen.be/ns/mandaat#"
:besluit "http://data.vlaanderen.be/ns/besluit#"
:lblodlg "http://data.lblod.info/vocabularies/leidinggevenden/"
:dc_terms "http://purl.org/dc/terms/"
:foaf "http://xmlns.com/foaf/0.1/"
:skos "http://www.w3.org/2004/02/skos/core#"
:euvoc "http://publications.europa.eu/ontology/euvoc#"
:ere "http://data.lblod.info/vocabularies/erediensten/"
:ch "http://data.lblod.info/vocabularies/contacthub/"
:code "http://lblod.data.gift/vocabularies/organisatie/"
:ext "http://mu.semte.ch/vocabularies/ext/"
:time "http://www.w3.org/2006/time#"
:oasis "https://docs.oasis-open-projects.org/oslc-op/core/v3.0/os/core-vocab.html#"
:nfo "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#"
:dcat "http://www.w3.org/ns/dcat#"
:besluitvorming "https://data.vlaanderen.be/ns/besluitvorming#"
:reporting "http://lblod.data.gift/vocabularies/reporting/"
:oslc "http://open-services.net/ns/core#"
:cogs "http://vocab.deri.ie/cogs#"
)
(type-cache::add-type-for-prefix "http://mu.semte.ch/sessions/" "http://mu.semte.ch/vocabularies/session/Session")
(define-graph acmidm-lezer ("http://mu.semte.ch/graphs/administrative-unit")
("dc_terms:Agent" -> _)
("org:Organization" -> _)
("regorg:RegisteredOrganization" -> _)
("besluit:Besluit" -> _)
("besluitvorming:Beslissingsactiviteit" -> _)
("org:Site" -> _)
("locn:Address" -> _)
("person:Person" -> _)
("schema:ContactPoint" -> _)
("besluit:Bestuurseenheid" -> _)
("besluit:Bestuursorgaan" -> _)
("adms:Identifier" -> _)
("generiek:GestructureerdeIdentificator" -> _)
("mandaat:Mandaat" -> _)
("mandaat:Mandataris" -> _)
("lblodlg:Functionaris" -> _)
("lblodlg:Bestuursfunctie" -> _)
("code:VeranderingsgebeurtenisResultaat" -> _)
("org:Post" -> _)
("org:ChangeEvent" -> _)
("ch:AgentInPositie" -> _)
("ext:KboOrganisatie" -> _)
("org:Membership" -> _)
("time:ProperInterval" -> _))
(define-graph acmidm-vendor ("http://mu.semte.ch/graphs/vendor-management-data")
("ext:Vendor" -> _))
(define-graph acmidm-editeerder ("http://mu.semte.ch/graphs/administrative-unit")
("oasis:Error" -> _)
("dc_terms:Agent" -> _)
("org:Organization" -> _)
("regorg:RegisteredOrganization" -> _)
("besluit:Besluit" -> _)
("besluitvorming:Beslissingsactiviteit" -> _)
("org:Site" -> _)
("locn:Address" -> _)
("person:Person" -> _)
("schema:ContactPoint" -> _)
("besluit:Bestuurseenheid" -> _)
("besluit:Bestuursorgaan" -> _)
("adms:Identifier" -> _)
("generiek:GestructureerdeIdentificator" -> _)
("mandaat:Mandaat" -> _)
("mandaat:Mandataris" -> _)
("lblodlg:Functionaris" -> _)
("lblodlg:Bestuursfunctie" -> _)
("code:VeranderingsgebeurtenisResultaat" -> _)
("org:Post" -> _)
("org:ChangeEvent" -> _)
("ch:AgentInPositie" -> _)
("ext:KboOrganisatie" -> _)
("org:Membership" -> _)
("time:ProperInterval" -> _))
(define-graph acmidm-worship-lezer ("http://mu.semte.ch/graphs/worship-service")
("ere:EredienstMandataris" -> _)
("ere:BestuurVanDeEredienst" -> _)
("ere:EredienstBestuurseenheid" -> _)
("ere:RolBedienaar" -> _)
("ere:VoorwaardenBedienaar" -> _)
("ere:PositieBedienaar" -> _)
("ere:BetrokkenLokaleBesturen" -> _)
("ere:VerbondenJuridischeStructuren" -> _)
("ere:CentraalBestuurVanDeEredienst" -> _)
("ere:RepresentatiefOrgaan" -> _)
("dc_terms:Agent" -> _)
("org:Organization" -> _)
("regorg:RegisteredOrganization" -> _)
("besluit:Besluit" -> _)
("besluitvorming:Beslissingsactiviteit" -> _)
("org:Site" -> _)
("locn:Address" -> _)
("person:Person" -> _)
("schema:ContactPoint" -> _)
("besluit:Bestuurseenheid" -> _)
("besluit:Bestuursorgaan" -> _)
("adms:Identifier" -> _)
("generiek:GestructureerdeIdentificator" -> _)
("mandaat:Mandaat" -> _)
("mandaat:Mandataris" -> _)
("lblodlg:Functionaris" -> _)
("lblodlg:Bestuursfunctie" -> _)
("code:VeranderingsgebeurtenisResultaat" -> _)
("org:Post" -> _)
("org:ChangeEvent" -> _)
("ch:AgentInPositie" -> _)
("ext:KboOrganisatie" -> _)
("org:Membership" -> _)
("time:ProperInterval" -> _))
(define-graph acmidm-worship-editeerder ("http://mu.semte.ch/graphs/worship-service")
("oasis:Error" -> _)
("ere:EredienstMandataris" -> _)
("ere:BestuurVanDeEredienst" -> _)
("ere:EredienstBestuurseenheid" -> _)
("ere:RolBedienaar" -> _)
("ere:VoorwaardenBedienaar" -> _)
("ere:PositieBedienaar" -> _)
("ere:BetrokkenLokaleBesturen" -> _)
("ere:VerbondenJuridischeStructuren" -> _)
("ere:CentraalBestuurVanDeEredienst" -> _)
("ere:RepresentatiefOrgaan" -> _)
("dc_terms:Agent" -> _)
("org:Organization" -> _)
("regorg:RegisteredOrganization" -> _)
("besluit:Besluit" -> _)
("besluitvorming:Beslissingsactiviteit" -> _)
("org:Site" -> _)
("locn:Address" -> _)
("person:Person" -> _)
("schema:ContactPoint" -> _)
("besluit:Bestuurseenheid" -> _)
("besluit:Bestuursorgaan" -> _)
("adms:Identifier" -> _)
("generiek:GestructureerdeIdentificator" -> _)
("mandaat:Mandaat" -> _)
("mandaat:Mandataris" -> _)
("lblodlg:Functionaris" -> _)
("lblodlg:Bestuursfunctie" -> _)
("code:VeranderingsgebeurtenisResultaat" -> _)
("org:Post" -> _)
("org:ChangeEvent" -> _)
("ch:AgentInPositie" -> _)
("ext:KboOrganisatie" -> _)
("org:Membership" -> _)
("time:ProperInterval" -> _))
(define-graph public ("http://mu.semte.ch/graphs/public")
("org:Role" -> _)
("besluit:Bestuurseenheid" -> _)
("foaf:Person" -> _)
("foaf:OnlineAccount" -> _)
("nfo:FileDataObject" -> _)
("dcat:Dataset" -> _)
("dcat:Distribution" -> _)
("dcat:Catalog" -> _)
("ext:GeslachtCode" -> _)
("lblodlg:FunctionarisStatusCode" -> _)
("code:OrganisatieStatusCode" -> _)
("code:BestuursfunctieCode" -> _)
("code:BestuursorgaanClassificatieCode" -> _)
("code:MandatarisStatusCode" -> _)
("code:BestuurseenheidClassificatieCode" -> _)
("ext:GeregistreerdeOrganisatieClassificatieCode" -> _)
("code:TypeEredienst" -> _)
("skos:ConceptScheme" -> _)
("code:BedienaarFinancieringCode" -> _)
("skos:Concept" -> _)
("euvoc:Country" -> _)
("code:TypeVestiging" -> _)
("code:HelftVerkiezing" -> _)
("code:Veranderingsgebeurtenis" -> _)
("code:TypeBetrokkenheid" -> _)
("code:VoorwaardenBedienaarCriterium" -> _)
("code:BedienaarCriteriumBewijsstuk" -> _)
("code:EredienstBeroepen" -> _)
("code:Rechtsvormtype" -> _)
("prov:Location" -> _))
(define-graph shared ("http://mu.semte.ch/graphs/shared")
("foaf:Image" -> _)
("nfo:FileDataObject" -> _)
("dc_terms:Agent" -> _)
("org:Organization" -> _)
("regorg:RegisteredOrganization" -> _)
("besluit:Besluit" -> _)
("besluitvorming:Beslissingsactiviteit" -> _)
("org:Site" -> _)
("locn:Address" -> _)
("person:Person" -> _)
("schema:ContactPoint" -> _)
("besluit:Bestuurseenheid" -> _)
("besluit:Bestuursorgaan" -> _)
("adms:Identifier" -> _)
("generiek:GestructureerdeIdentificator" -> _)
("mandaat:Mandaat" -> _)
("mandaat:Mandataris" -> _)
("lblodlg:Functionaris" -> _)
("lblodlg:Bestuursfunctie" -> _)
("code:VeranderingsgebeurtenisResultaat" -> _)
("org:Post" -> _)
("org:ChangeEvent" -> _)
("ch:AgentInPositie" -> _)
("ext:KboOrganisatie" -> _)
("org:Membership" -> _)
("time:ProperInterval" -> _))
(define-graph reports ("http://mu.semte.ch/graphs/reports")
("reporting:Report" -> _)
("oslc:Error" -> _)
("nfo:DataContainer" -> _)
("nfo:FileDataObject" -> _))
(define-graph system-jobs ("http://mu.semte.ch/graphs/system/jobs")
("cogs:Job" -> _)
("nfo:DataContainer" -> _)
("nfo:FileDataObject" -> _))
(define-graph jobs ("http://mu.semte.ch/graphs/jobs")
("cogs:Job" -> _)
("nfo:DataContainer" -> _)
("nfo:FileDataObject" -> _))
(supply-allowed-group "public")
(supply-allowed-group "o-admin-rwf"
:parameters ()
:query "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
SELECT DISTINCT ?session WHERE {
<SESSION_ID> ext:sessionRole \"LoketLB-AdminDashboardOrganisatiePortaalGebruiker\" .
}")
(supply-allowed-group "ABBOrganisatiePortaalGebruiker-lezer"
:parameters ()
:query "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
SELECT DISTINCT ?session_group ?session_role WHERE {
<SESSION_ID> ext:sessionGroup/mu:uuid ?session_group;
ext:activeSessionRole ?session_role.
FILTER( ?session_role = \"ABBOrganisatiePortaalGebruiker-lezer\" )
}")
(supply-allowed-group "ABBOrganisatiePortaalGebruiker-editeerder"
:parameters ()
:query "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
SELECT DISTINCT ?session_group ?session_role WHERE {
<SESSION_ID> ext:sessionGroup/mu:uuid ?session_group;
ext:activeSessionRole ?session_role.
FILTER( ?session_role = \"ABBOrganisatiePortaalGebruiker-editeerder\" )
}")
(supply-allowed-group "ABBOrganisatiePortaalGebruiker-beheerder"
:parameters ()
:query "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
SELECT DISTINCT ?session_group ?session_role WHERE {
<SESSION_ID> ext:sessionGroup/mu:uuid ?session_group;
ext:activeSessionRole ?session_role.
FILTER( ?session_role = \"ABBOrganisatiePortaalGebruiker-beheerder\" )
}")
(supply-allowed-group "ABBOrganisatiePortaalErediensten-lezer"
:parameters ()
:query "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
SELECT DISTINCT ?session_group ?session_role WHERE {
<SESSION_ID> ext:sessionGroup/mu:uuid ?session_group;
ext:activeSessionRole ?session_role.
FILTER( ?session_role = \"ABBOrganisatiePortaalErediensten-lezer\" )
}")
(supply-allowed-group "ABBOrganisatiePortaalErediensten-editeerder"
:parameters ()
:query "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
SELECT DISTINCT ?session_group ?session_role WHERE {
<SESSION_ID> ext:sessionGroup/mu:uuid ?session_group;
ext:activeSessionRole ?session_role.
FILTER( ?session_role = \"ABBOrganisatiePortaalErediensten-editeerder\" )
}")
(supply-allowed-group "ABBOrganisatiePortaalErediensten-beheerder"
:parameters ()
:query "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
SELECT DISTINCT ?session_group ?session_role WHERE {
<SESSION_ID> ext:sessionGroup/mu:uuid ?session_group;
ext:activeSessionRole ?session_role.
FILTER( ?session_role = \"ABBOrganisatiePortaalErediensten-beheerder\" )
}")
(grant (read)
:to-graph (acmidm-lezer acmidm-vendor)
:for-allowed-group "ABBOrganisatiePortaalGebruiker-lezer")
(grant (read write)
:to-graph (acmidm-editeerder acmidm-vendor)
:for-allowed-group "ABBOrganisatiePortaalGebruiker-editeerder")
(grant (read write)
:to-graph (acmidm-editeerder acmidm-vendor)
:for-allowed-group "ABBOrganisatiePortaalGebruiker-beheerder")
(grant (read)
:to-graph (acmidm-worship-lezer acmidm-vendor)
:for-allowed-group "ABBOrganisatiePortaalErediensten-lezer")
(grant (read write)
:to-graph (acmidm-worship-editeerder acmidm-vendor)
:for-allowed-group "ABBOrganisatiePortaalErediensten-editeerder")
(grant (read write)
:to-graph (acmidm-worship-editeerder acmidm-vendor)
:for-allowed-group "ABBOrganisatiePortaalErediensten-beheerder")
(grant (read)
:to-graph (public shared)
:for-allowed-group "public")
(grant (read write)
:to-graph (reports jobs system-jobs)
:for-allowed-group "o-admin-rwf")

5
config/authorization/delta.ex
View File

@@ -1,5 +0,0 @@
defmodule Delta.Config do
def targets do
[ "http://deltanotifier" ]
end
end

7
docker-compose.yml
View File

@@ -33,8 +33,9 @@ services:
restart: always
logging: *default-logging
db:
image: semtech/mu-authorization:feature-service-roam-r1.1
image: semtech/sparql-parser:0.0.15
environment:
LISP_DYNAMIC_SPACE_SIZE: 8192
MU_SPARQL_ENDPOINT: "http://triplestore:8890/sparql"
LOG_OUTGOING_SPARQL_QUERIES: "true"
LOG_INCOMING_SPARQL_QUERIES: "true"
@@ -45,6 +46,7 @@ services:
QUERY_MAX_EXECUTION_TIME: "300000"
volumes:
- ./config/authorization:/config
- ./data/authorization:/data
labels:
- "logging=true"
restart: always
@@ -89,9 +91,10 @@ services:
restart: always
logging: *default-logging
resource:
image: semtech/mu-cl-resources:1.24.0
image: semtech/mu-cl-resources:1.27.2
environment:
CACHE_CLEAR_PATH: "http://cache/.mu/clear-keys"
LISP_DYNAMIC_SPACE_SIZE: "8192" # 1GB by default, increase to 8GB on systems with a lot of data
links:
- db:database
volumes: