From 0de3869c4f1b2c998b202ba6de1424bc3a8dafdb Mon Sep 17 00:00:00 2001 From: Damon Date: Thu, 23 Apr 2026 16:22:11 +0200 Subject: [PATCH] DL-6575: added sparql-parser + edit changelog --- CHANGELOG.md | 5 +- config/authorization/config.ex | 311 -------------------------- config/authorization/config.lisp | 368 +++++++++++++++++++++++++++++++ config/authorization/delta.ex | 5 - docker-compose.yml | 3 +- 5 files changed, 373 insertions(+), 319 deletions(-) delete mode 100644 config/authorization/config.ex create mode 100644 config/authorization/config.lisp delete mode 100644 config/authorization/delta.ex diff --git a/CHANGELOG.md b/CHANGELOG.md index 5beca2b..94c6867 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,11 +7,12 @@ - Add column to query organizations in Dashboard [OP-3758] - Query list change events of organisations in Dashboard [OP-3760] - Disable SPARQL endpoint +- sparql-parser [DL-6575] ### Deploy notes ``` -drc pull kbo-data-sync && drc up -d kbo-data-sync -drc restart report-generation +drc pull kbo-data-sync db && drc up -d kbo-data-sync db +drc restart report-generation drc restart migrations && drc logs -ft --tail=200 migrations drc up -d delta-producer-publication-graph-maintainer drc restart dispatcher diff --git a/config/authorization/config.ex b/config/authorization/config.ex deleted file mode 100644 index 0966921..0000000 --- a/config/authorization/config.ex +++ /dev/null @@ -1,311 +0,0 @@ -alias Acl.Accessibility.Always, as: AlwaysAccessible -alias Acl.GraphSpec.Constraint.Resource, as: ResourceConstraint -alias Acl.GraphSpec.Constraint.ResourceFormat, as: ResourceFormatConstraint -alias Acl.Accessibility.ByQuery, as: AccessByQuery -alias Acl.GraphSpec, as: GraphSpec -alias Acl.GroupSpec, as: GroupSpec -alias Acl.GroupSpec.GraphCleanup, as: GraphCleanup - -defmodule Acl.UserGroups.Config do - @error_type [ - "https://docs.oasis-open-projects.org/oslc-op/core/v3.0/os/core-vocab.html#Error" - ] - - @worship_type [ - "http://data.lblod.info/vocabularies/erediensten/EredienstMandataris", - "http://data.lblod.info/vocabularies/erediensten/BestuurVanDeEredienst", - "http://data.lblod.info/vocabularies/erediensten/EredienstBestuurseenheid", - "http://data.lblod.info/vocabularies/erediensten/RolBedienaar", - "http://data.lblod.info/vocabularies/erediensten/VoorwaardenBedienaar", - "http://data.lblod.info/vocabularies/erediensten/PositieBedienaar", - "http://data.lblod.info/vocabularies/erediensten/BetrokkenLokaleBesturen", - "http://data.lblod.info/vocabularies/erediensten/VerbondenJuridischeStructuren", - "http://data.lblod.info/vocabularies/erediensten/CentraalBestuurVanDeEredienst", - "http://data.lblod.info/vocabularies/erediensten/RepresentatiefOrgaan" - ] - - @public_type [ - "http://www.w3.org/ns/org#Role", - "http://data.vlaanderen.be/ns/besluit#Bestuurseenheid", - "http://xmlns.com/foaf/0.1/Person", - "http://xmlns.com/foaf/0.1/OnlineAccount", - "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject", - "http://www.w3.org/ns/dcat#Dataset", - "http://www.w3.org/ns/dcat#Distribution", - "http://www.w3.org/ns/dcat#Catalog", - "http://mu.semte.ch/vocabularies/ext/GeslachtCode", - "http://data.lblod.info/vocabularies/leidinggevenden/FunctionarisStatusCode", - "http://lblod.data.gift/vocabularies/organisatie/OrganisatieStatusCode", - "http://lblod.data.gift/vocabularies/organisatie/BestuursfunctieCode", - "http://lblod.data.gift/vocabularies/organisatie/BestuursorgaanClassificatieCode", - "http://lblod.data.gift/vocabularies/organisatie/MandatarisStatusCode", - "http://lblod.data.gift/vocabularies/organisatie/BestuurseenheidClassificatieCode", - "http://mu.semte.ch/vocabularies/ext/GeregistreerdeOrganisatieClassificatieCode", - "http://lblod.data.gift/vocabularies/organisatie/TypeEredienst", - "http://www.w3.org/2004/02/skos/core#ConceptScheme", - "http://lblod.data.gift/vocabularies/organisatie/BedienaarFinancieringCode", - "http://www.w3.org/2004/02/skos/core#Concept", - "http://publications.europa.eu/ontology/euvoc#Country", - "http://lblod.data.gift/vocabularies/organisatie/TypeVestiging", - "http://lblod.data.gift/vocabularies/organisatie/HelftVerkiezing", - "http://lblod.data.gift/vocabularies/organisatie/Veranderingsgebeurtenis", - "http://lblod.data.gift/vocabularies/organisatie/TypeBetrokkenheid", - "http://lblod.data.gift/vocabularies/organisatie/VoorwaardenBedienaarCriterium", - "http://lblod.data.gift/vocabularies/organisatie/BedienaarCriteriumBewijsstuk", - "http://lblod.data.gift/vocabularies/organisatie/EredienstBeroepen", - "http://lblod.data.gift/vocabularies/organisatie/Rechtsvormtype", - "http://www.w3.org/ns/prov#Location" - ] - - @org_type [ - "http://purl.org/dc/terms/Agent", - "http://www.w3.org/ns/org#Organization", - "http://www.w3.org/ns/regorg#RegisteredOrganization", - "http://data.vlaanderen.be/ns/besluit#Besluit", - "https://data.vlaanderen.be/ns/besluitvorming#Beslissingsactiviteit", - "http://www.w3.org/ns/org#Site", - "http://www.w3.org/ns/locn#Address", - "http://www.w3.org/ns/person#Person", - "http://schema.org/ContactPoint", - "http://data.vlaanderen.be/ns/besluit#Bestuurseenheid", - "http://data.vlaanderen.be/ns/besluit#Bestuursorgaan", - "http://www.w3.org/ns/adms#Identifier", - "https://data.vlaanderen.be/ns/generiek#GestructureerdeIdentificator", - "http://data.vlaanderen.be/ns/mandaat#Mandaat", - "http://data.vlaanderen.be/ns/mandaat#Mandataris", - "http://data.lblod.info/vocabularies/leidinggevenden/Functionaris", - "http://data.lblod.info/vocabularies/leidinggevenden/Bestuursfunctie", - "http://lblod.data.gift/vocabularies/organisatie/VeranderingsgebeurtenisResultaat", - "http://www.w3.org/ns/org#Post", - "http://www.w3.org/ns/org#ChangeEvent", - "http://data.lblod.info/vocabularies/contacthub/AgentInPositie", - "http://mu.semte.ch/vocabularies/ext/KboOrganisatie", - "http://www.w3.org/ns/org#Membership", - "http://www.w3.org/2006/time#ProperInterval", - ] - - @shared_protected_type [ - "http://xmlns.com/foaf/0.1/Image", - "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject" - ] - - @vendor_type [ - "http://mu.semte.ch/vocabularies/ext/Vendor" - ] - - - defp access_by_role(group_string) do - %AccessByQuery{ - # vars: ["session_group","session_role"], todo we might have to create multiple graph depending on role - vars: [], - query: sparql_query_for_access_role(group_string) - } - end - - defp sparql_query_for_access_role(group_string) do - "PREFIX ext: - PREFIX mu: - SELECT distinct ?session_group ?session_role WHERE { - ext:sessionGroup/mu:uuid ?session_group; - ext:activeSessionRole ?session_role. - FILTER( ?session_role = \"#{group_string}\" ) - }" - end - - defp can_access_dashboard() do - %AccessByQuery{ - vars: [], - query: "PREFIX ext: - SELECT DISTINCT ?session WHERE { - VALUES ?session { } - ?session ext:sessionRole \"LoketLB-AdminDashboardOrganisatiePortaalGebruiker\" . - }" - } - end - - def user_groups do - [ - %GroupSpec{ - name: "acmidm-lezer", - useage: [:read], - access: access_by_role("ABBOrganisatiePortaalGebruiker-lezer"), - graphs: [ - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/administrative-unit", - constraint: %ResourceConstraint{ - resource_types: @org_type - } - }, - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/vendor-management-data", - constraint: %ResourceConstraint{ - resource_types: @vendor_type - } - } - ] - }, - %GroupSpec{ - name: "acmidm-editeerder", - useage: [:read, :write, :read_for_write], - access: access_by_role("ABBOrganisatiePortaalGebruiker-editeerder"), - graphs: [ - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/administrative-unit", - constraint: %ResourceConstraint{ - resource_types: @org_type ++ @error_type - } - }, - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/vendor-management-data", - constraint: %ResourceConstraint{ - resource_types: @vendor_type - } - } - ] - }, - %GroupSpec{ - name: "acmidm-beheerder", - useage: [:read, :write, :read_for_write], - access: access_by_role("ABBOrganisatiePortaalGebruiker-beheerder"), - graphs: [ - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/administrative-unit", - constraint: %ResourceConstraint{ - resource_types: @org_type ++ @error_type - } - }, - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/vendor-management-data", - constraint: %ResourceConstraint{ - resource_types: @vendor_type - } - } - ] - }, - %GroupSpec{ - name: "acmidm-worship-lezer", - useage: [:read], - access: access_by_role("ABBOrganisatiePortaalErediensten-lezer"), - graphs: [ - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/worship-service", - constraint: %ResourceConstraint{ - resource_types: @org_type ++ @worship_type - } - }, - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/vendor-management-data", - constraint: %ResourceConstraint{ - resource_types: @vendor_type - } - } - ] - }, - %GroupSpec{ - name: "acmidm-worship-editeerder", - useage: [:read, :write, :read_for_write], - access: access_by_role("ABBOrganisatiePortaalErediensten-editeerder"), - graphs: [ - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/worship-service", - constraint: %ResourceConstraint{ - resource_types: @org_type ++ @error_type ++ @worship_type - } - }, - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/vendor-management-data", - constraint: %ResourceConstraint{ - resource_types: @vendor_type - } - } - ] - }, - %GroupSpec{ - name: "acmidm-worship-beheerder", - useage: [:read, :write, :read_for_write], - access: access_by_role("ABBOrganisatiePortaalErediensten-beheerder"), - graphs: [ - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/worship-service", - constraint: %ResourceConstraint{ - resource_types: @org_type ++ @error_type ++ @worship_type - } - }, - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/vendor-management-data", - constraint: %ResourceConstraint{ - resource_types: @vendor_type - } - } - ] - }, - %GroupSpec{ - name: "public", - useage: [:read], - access: %AlwaysAccessible{}, - graphs: [ - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/public", - constraint: %ResourceConstraint{ - resource_types: @public_type - } - }, - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/shared", - constraint: %ResourceConstraint{ - resource_types: @shared_protected_type ++ @org_type - } - } - ] - }, - # // Dashboard admin - %GroupSpec{ - name: "o-admin-rwf", - useage: [:read, :write, :read_for_write], - access: can_access_dashboard(), - graphs: [ - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/reports", - constraint: %ResourceConstraint{ - resource_types: [ - "http://lblod.data.gift/vocabularies/reporting/Report", - "http://open-services.net/ns/core#Error", - "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#DataContainer", - "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject" - ] - } - }, - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/system/jobs", - constraint: %ResourceConstraint{ - resource_types: [ - "http://vocab.deri.ie/cogs#Job", - "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#DataContainer", - "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject" - ] - } - }, - # OP stores jobs in multiple graphs, so we configure both until they are merged into one graph - %GraphSpec{ - graph: "http://mu.semte.ch/graphs/jobs", - constraint: %ResourceConstraint{ - resource_types: [ - "http://vocab.deri.ie/cogs#Job", - "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#DataContainer", - "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject" - ] - } - } - ] - }, - - # // CLEANUP - # - %GraphCleanup{ - originating_graph: "http://mu.semte.ch/application", - useage: [:write], - name: "clean" - } - ] - end -end diff --git a/config/authorization/config.lisp b/config/authorization/config.lisp new file mode 100644 index 0000000..45b0b2b --- /dev/null +++ b/config/authorization/config.lisp @@ -0,0 +1,368 @@ +;;;;;;;;;;;;;;;;;;; +;;; delta messenger +(in-package :delta-messenger) + +(add-delta-logger) +(add-delta-messenger "http://deltanotifier/") + +;;;;;;;;;;;;;;;;; +;;; configuration +(in-package :client) +(setf *log-sparql-query-roundtrip* t) +(setf *backend* "http://triplestore:8890/sparql") + +(in-package :server) +(setf *log-incoming-requests-p* nil) + +;;;;;;;;;;;;;;;;; +;;; access rights +(in-package :acl) + +(defparameter *access-specifications* nil + "All known ACCESS specifications.") + +(defparameter *graphs* nil + "All known GRAPH-SPECIFICATION instances.") + +(defparameter *rights* nil + "All known GRANT instances connecting ACCESS-SPECIFICATION to GRAPH.") + +;; Prefixes used in the constraints below (not in the SPARQL queries) +(define-prefixes + :org "http://www.w3.org/ns/org#" + :locn "http://www.w3.org/ns/locn#" + :schema "http://schema.org/" + :regorg "http://www.w3.org/ns/regorg#" + :person "http://www.w3.org/ns/person#" + :adms "http://www.w3.org/ns/adms#" + :prov "http://www.w3.org/ns/prov#" + :generiek "https://data.vlaanderen.be/ns/generiek#" + :mandaat "http://data.vlaanderen.be/ns/mandaat#" + :besluit "http://data.vlaanderen.be/ns/besluit#" + :lblodlg "http://data.lblod.info/vocabularies/leidinggevenden/" + :dc_terms "http://purl.org/dc/terms/" + :foaf "http://xmlns.com/foaf/0.1/" + :skos "http://www.w3.org/2004/02/skos/core#" + :euvoc "http://publications.europa.eu/ontology/euvoc#" + :ere "http://data.lblod.info/vocabularies/erediensten/" + :ch "http://data.lblod.info/vocabularies/contacthub/" + :code "http://lblod.data.gift/vocabularies/organisatie/" + :ext "http://mu.semte.ch/vocabularies/ext/" + :time "http://www.w3.org/2006/time#" + :oasis "https://docs.oasis-open-projects.org/oslc-op/core/v3.0/os/core-vocab.html#" + :nfo "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#" + :dcat "http://www.w3.org/ns/dcat#" + :besluitvorming "https://data.vlaanderen.be/ns/besluitvorming#" + :reporting "http://lblod.data.gift/vocabularies/reporting/" + :oslc "http://open-services.net/ns/core#" + :cogs "http://vocab.deri.ie/cogs#" + ) + +(type-cache::add-type-for-prefix "http://mu.semte.ch/sessions/" "http://mu.semte.ch/vocabularies/session/Session") + +(define-graph acmidm-lezer ("http://mu.semte.ch/graphs/administrative-unit") + ("dc_terms:Agent" -> _) + ("org:Organization" -> _) + ("regorg:RegisteredOrganization" -> _) + ("besluit:Besluit" -> _) + ("besluitvorming:Beslissingsactiviteit" -> _) + ("org:Site" -> _) + ("locn:Address" -> _) + ("person:Person" -> _) + ("schema:ContactPoint" -> _) + ("besluit:Bestuurseenheid" -> _) + ("besluit:Bestuursorgaan" -> _) + ("adms:Identifier" -> _) + ("generiek:GestructureerdeIdentificator" -> _) + ("mandaat:Mandaat" -> _) + ("mandaat:Mandataris" -> _) + ("lblodlg:Functionaris" -> _) + ("lblodlg:Bestuursfunctie" -> _) + ("code:VeranderingsgebeurtenisResultaat" -> _) + ("org:Post" -> _) + ("org:ChangeEvent" -> _) + ("ch:AgentInPositie" -> _) + ("ext:KboOrganisatie" -> _) + ("org:Membership" -> _) + ("time:ProperInterval" -> _)) + +(define-graph acmidm-vendor ("http://mu.semte.ch/graphs/vendor-management-data") + ("ext:Vendor" -> _)) + +(define-graph acmidm-editeerder ("http://mu.semte.ch/graphs/administrative-unit") + ("oasis:Error" -> _) + ("dc_terms:Agent" -> _) + ("org:Organization" -> _) + ("regorg:RegisteredOrganization" -> _) + ("besluit:Besluit" -> _) + ("besluitvorming:Beslissingsactiviteit" -> _) + ("org:Site" -> _) + ("locn:Address" -> _) + ("person:Person" -> _) + ("schema:ContactPoint" -> _) + ("besluit:Bestuurseenheid" -> _) + ("besluit:Bestuursorgaan" -> _) + ("adms:Identifier" -> _) + ("generiek:GestructureerdeIdentificator" -> _) + ("mandaat:Mandaat" -> _) + ("mandaat:Mandataris" -> _) + ("lblodlg:Functionaris" -> _) + ("lblodlg:Bestuursfunctie" -> _) + ("code:VeranderingsgebeurtenisResultaat" -> _) + ("org:Post" -> _) + ("org:ChangeEvent" -> _) + ("ch:AgentInPositie" -> _) + ("ext:KboOrganisatie" -> _) + ("org:Membership" -> _) + ("time:ProperInterval" -> _)) + +(define-graph acmidm-worship-lezer ("http://mu.semte.ch/graphs/worship-service") + ("ere:EredienstMandataris" -> _) + ("ere:BestuurVanDeEredienst" -> _) + ("ere:EredienstBestuurseenheid" -> _) + ("ere:RolBedienaar" -> _) + ("ere:VoorwaardenBedienaar" -> _) + ("ere:PositieBedienaar" -> _) + ("ere:BetrokkenLokaleBesturen" -> _) + ("ere:VerbondenJuridischeStructuren" -> _) + ("ere:CentraalBestuurVanDeEredienst" -> _) + ("ere:RepresentatiefOrgaan" -> _) + ("dc_terms:Agent" -> _) + ("org:Organization" -> _) + ("regorg:RegisteredOrganization" -> _) + ("besluit:Besluit" -> _) + ("besluitvorming:Beslissingsactiviteit" -> _) + ("org:Site" -> _) + ("locn:Address" -> _) + ("person:Person" -> _) + ("schema:ContactPoint" -> _) + ("besluit:Bestuurseenheid" -> _) + ("besluit:Bestuursorgaan" -> _) + ("adms:Identifier" -> _) + ("generiek:GestructureerdeIdentificator" -> _) + ("mandaat:Mandaat" -> _) + ("mandaat:Mandataris" -> _) + ("lblodlg:Functionaris" -> _) + ("lblodlg:Bestuursfunctie" -> _) + ("code:VeranderingsgebeurtenisResultaat" -> _) + ("org:Post" -> _) + ("org:ChangeEvent" -> _) + ("ch:AgentInPositie" -> _) + ("ext:KboOrganisatie" -> _) + ("org:Membership" -> _) + ("time:ProperInterval" -> _)) + +(define-graph acmidm-worship-editeerder ("http://mu.semte.ch/graphs/worship-service") + ("oasis:Error" -> _) + ("ere:EredienstMandataris" -> _) + ("ere:BestuurVanDeEredienst" -> _) + ("ere:EredienstBestuurseenheid" -> _) + ("ere:RolBedienaar" -> _) + ("ere:VoorwaardenBedienaar" -> _) + ("ere:PositieBedienaar" -> _) + ("ere:BetrokkenLokaleBesturen" -> _) + ("ere:VerbondenJuridischeStructuren" -> _) + ("ere:CentraalBestuurVanDeEredienst" -> _) + ("ere:RepresentatiefOrgaan" -> _) + ("dc_terms:Agent" -> _) + ("org:Organization" -> _) + ("regorg:RegisteredOrganization" -> _) + ("besluit:Besluit" -> _) + ("besluitvorming:Beslissingsactiviteit" -> _) + ("org:Site" -> _) + ("locn:Address" -> _) + ("person:Person" -> _) + ("schema:ContactPoint" -> _) + ("besluit:Bestuurseenheid" -> _) + ("besluit:Bestuursorgaan" -> _) + ("adms:Identifier" -> _) + ("generiek:GestructureerdeIdentificator" -> _) + ("mandaat:Mandaat" -> _) + ("mandaat:Mandataris" -> _) + ("lblodlg:Functionaris" -> _) + ("lblodlg:Bestuursfunctie" -> _) + ("code:VeranderingsgebeurtenisResultaat" -> _) + ("org:Post" -> _) + ("org:ChangeEvent" -> _) + ("ch:AgentInPositie" -> _) + ("ext:KboOrganisatie" -> _) + ("org:Membership" -> _) + ("time:ProperInterval" -> _)) + +(define-graph public ("http://mu.semte.ch/graphs/public") + ("org:Role" -> _) + ("besluit:Bestuurseenheid" -> _) + ("foaf:Person" -> _) + ("foaf:OnlineAccount" -> _) + ("nfo:FileDataObject" -> _) + ("dcat:Dataset" -> _) + ("dcat:Distribution" -> _) + ("dcat:Catalog" -> _) + ("ext:GeslachtCode" -> _) + ("lblodlg:FunctionarisStatusCode" -> _) + ("code:OrganisatieStatusCode" -> _) + ("code:BestuursfunctieCode" -> _) + ("code:BestuursorgaanClassificatieCode" -> _) + ("code:MandatarisStatusCode" -> _) + ("code:BestuurseenheidClassificatieCode" -> _) + ("ext:GeregistreerdeOrganisatieClassificatieCode" -> _) + ("code:TypeEredienst" -> _) + ("skos:ConceptScheme" -> _) + ("code:BedienaarFinancieringCode" -> _) + ("skos:Concept" -> _) + ("euvoc:Country" -> _) + ("code:TypeVestiging" -> _) + ("code:HelftVerkiezing" -> _) + ("code:Veranderingsgebeurtenis" -> _) + ("code:TypeBetrokkenheid" -> _) + ("code:VoorwaardenBedienaarCriterium" -> _) + ("code:BedienaarCriteriumBewijsstuk" -> _) + ("code:EredienstBeroepen" -> _) + ("code:Rechtsvormtype" -> _) + ("prov:Location" -> _)) + +(define-graph shared ("http://mu.semte.ch/graphs/shared") + ("foaf:Image" -> _) + ("nfo:FileDataObject" -> _) + ("dc_terms:Agent" -> _) + ("org:Organization" -> _) + ("regorg:RegisteredOrganization" -> _) + ("besluit:Besluit" -> _) + ("besluitvorming:Beslissingsactiviteit" -> _) + ("org:Site" -> _) + ("locn:Address" -> _) + ("person:Person" -> _) + ("schema:ContactPoint" -> _) + ("besluit:Bestuurseenheid" -> _) + ("besluit:Bestuursorgaan" -> _) + ("adms:Identifier" -> _) + ("generiek:GestructureerdeIdentificator" -> _) + ("mandaat:Mandaat" -> _) + ("mandaat:Mandataris" -> _) + ("lblodlg:Functionaris" -> _) + ("lblodlg:Bestuursfunctie" -> _) + ("code:VeranderingsgebeurtenisResultaat" -> _) + ("org:Post" -> _) + ("org:ChangeEvent" -> _) + ("ch:AgentInPositie" -> _) + ("ext:KboOrganisatie" -> _) + ("org:Membership" -> _) + ("time:ProperInterval" -> _)) + +(define-graph reports ("http://mu.semte.ch/graphs/reports") + ("reporting:Report" -> _) + ("oslc:Error" -> _) + ("nfo:DataContainer" -> _) + ("nfo:FileDataObject" -> _)) + +(define-graph system-jobs ("http://mu.semte.ch/graphs/system/jobs") + ("cogs:Job" -> _) + ("nfo:DataContainer" -> _) + ("nfo:FileDataObject" -> _)) + +(define-graph jobs ("http://mu.semte.ch/graphs/jobs") + ("cogs:Job" -> _) + ("nfo:DataContainer" -> _) + ("nfo:FileDataObject" -> _)) + +(supply-allowed-group "public") + +(supply-allowed-group "o-admin-rwf" + :parameters () + :query "PREFIX ext: + SELECT DISTINCT ?session WHERE { + ext:sessionRole \"LoketLB-AdminDashboardOrganisatiePortaalGebruiker\" . + }") + +(supply-allowed-group "ABBOrganisatiePortaalGebruiker-lezer" + :parameters () + :query "PREFIX ext: + PREFIX mu: + SELECT DISTINCT ?session_group ?session_role WHERE { + ext:sessionGroup/mu:uuid ?session_group; + ext:activeSessionRole ?session_role. + FILTER( ?session_role = \"ABBOrganisatiePortaalGebruiker-lezer\" ) + }") + +(supply-allowed-group "ABBOrganisatiePortaalGebruiker-editeerder" + :parameters () + :query "PREFIX ext: + PREFIX mu: + SELECT DISTINCT ?session_group ?session_role WHERE { + ext:sessionGroup/mu:uuid ?session_group; + ext:activeSessionRole ?session_role. + FILTER( ?session_role = \"ABBOrganisatiePortaalGebruiker-editeerder\" ) + }") + +(supply-allowed-group "ABBOrganisatiePortaalGebruiker-beheerder" + :parameters () + :query "PREFIX ext: + PREFIX mu: + SELECT DISTINCT ?session_group ?session_role WHERE { + ext:sessionGroup/mu:uuid ?session_group; + ext:activeSessionRole ?session_role. + FILTER( ?session_role = \"ABBOrganisatiePortaalGebruiker-beheerder\" ) + }") + + +(supply-allowed-group "ABBOrganisatiePortaalErediensten-lezer" + :parameters () + :query "PREFIX ext: + PREFIX mu: + SELECT DISTINCT ?session_group ?session_role WHERE { + ext:sessionGroup/mu:uuid ?session_group; + ext:activeSessionRole ?session_role. + FILTER( ?session_role = \"ABBOrganisatiePortaalErediensten-lezer\" ) + }") + +(supply-allowed-group "ABBOrganisatiePortaalErediensten-editeerder" + :parameters () + :query "PREFIX ext: + PREFIX mu: + SELECT DISTINCT ?session_group ?session_role WHERE { + ext:sessionGroup/mu:uuid ?session_group; + ext:activeSessionRole ?session_role. + FILTER( ?session_role = \"ABBOrganisatiePortaalErediensten-editeerder\" ) + }") + +(supply-allowed-group "ABBOrganisatiePortaalErediensten-beheerder" + :parameters () + :query "PREFIX ext: + PREFIX mu: + SELECT DISTINCT ?session_group ?session_role WHERE { + ext:sessionGroup/mu:uuid ?session_group; + ext:activeSessionRole ?session_role. + FILTER( ?session_role = \"ABBOrganisatiePortaalErediensten-beheerder\" ) + }") + +(grant (read) + :to-graph (acmidm-lezer acmidm-vendor) + :for-allowed-group "ABBOrganisatiePortaalGebruiker-lezer") + +(grant (read write) + :to-graph (acmidm-editeerder acmidm-vendor) + :for-allowed-group "ABBOrganisatiePortaalGebruiker-editeerder") + +(grant (read write) + :to-graph (acmidm-editeerder acmidm-vendor) + :for-allowed-group "ABBOrganisatiePortaalGebruiker-beheerder") + +(grant (read) + :to-graph (acmidm-worship-lezer acmidm-vendor) + :for-allowed-group "ABBOrganisatiePortaalErediensten-lezer") + +(grant (read write) + :to-graph (acmidm-worship-editeerder acmidm-vendor) + :for-allowed-group "ABBOrganisatiePortaalErediensten-editeerder") + +(grant (read write) + :to-graph (acmidm-worship-editeerder acmidm-vendor) + :for-allowed-group "ABBOrganisatiePortaalErediensten-beheerder") + +(grant (read) + :to-graph (public shared) + :for-allowed-group "public") + +(grant (read write) + :to-graph (reports jobs system-jobs) + :for-allowed-group "o-admin-rwf") \ No newline at end of file diff --git a/config/authorization/delta.ex b/config/authorization/delta.ex deleted file mode 100644 index 0c0e26c..0000000 --- a/config/authorization/delta.ex +++ /dev/null @@ -1,5 +0,0 @@ -defmodule Delta.Config do - def targets do - [ "http://deltanotifier" ] - end -end \ No newline at end of file diff --git a/docker-compose.yml b/docker-compose.yml index 804b634..1f994cb 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -33,7 +33,7 @@ services: restart: always logging: *default-logging db: - image: semtech/mu-authorization:feature-service-roam-r1.1 + image: semtech/sparql-parser:0.0.15 environment: MU_SPARQL_ENDPOINT: "http://triplestore:8890/sparql" LOG_OUTGOING_SPARQL_QUERIES: "true" @@ -45,6 +45,7 @@ services: QUERY_MAX_EXECUTION_TIME: "300000" volumes: - ./config/authorization:/config + - ./data/authorization:/data labels: - "logging=true" restart: always