felix.ruizdearcaute/app-organization-portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'master' into feature/adapt-public-producer-to-hardsplit

Browse Source
This commit is contained in:
Claire Lovisa
2023-03-21 17:19:56 +01:00
committed by GitHub
parent be12f3587a 7b2b577cc1
commit 86d30c2b37
77 changed files with 3971 additions and 609 deletions
Download Patch File Download Diff File Expand all files Collapse all files

181
config/authorization/config.ex
View File

@@ -8,70 +8,87 @@ alias Acl.GroupSpec.GraphCleanup, as: GraphCleanup
defmodule Acl.UserGroups.Config do
@error_type [
"https://docs.oasis-open-projects.org/oslc-op/core/v3.0/os/core-vocab.html#Error"
]
@error_type [
"https://docs.oasis-open-projects.org/oslc-op/core/v3.0/os/core-vocab.html#Error"
]
@protected_resource_type [
"http://www.w3.org/ns/org#Organization",
"http://data.vlaanderen.be/ns/besluit#Besluit",
"https://data.vlaanderen.be/ns/besluitvorming#Beslissingsactiviteit",
"http://data.vlaanderen.be/ns/besluit#Bestuurseenheid",
@worship_type [
"http://data.lblod.info/vocabularies/erediensten/EredienstMandataris",
"http://data.lblod.info/vocabularies/erediensten/BestuurVanDeEredienst",
"http://data.lblod.info/vocabularies/erediensten/EredienstBestuurseenheid",
"http://data.vlaanderen.be/ns/besluit#Bestuursorgaan",
"http://data.lblod.info/vocabularies/erediensten/RolBedienaar",
"http://data.lblod.info/vocabularies/erediensten/VoorwaardenBedienaar",
"https://data.vlaanderen.be/ns/persoon#Geboorte",
"http://mu.semte.ch/vocabularies/ext/GeslachtCode",
"http://data.lblod.info/vocabularies/erediensten/PositieBedienaar",
"http://www.w3.org/ns/adms#Identifier",
"https://data.vlaanderen.be/ns/generiek#GestructureerdeIdentificator",
"http://www.w3.org/ns/org#ChangeEvent",
"http://data.lblod.info/vocabularies/erediensten/BetrokkenLokaleBesturen",
"http://data.lblod.info/vocabularies/erediensten/VerbondenJuridischeStructuren",
"http://www.w3.org/ns/prov#Location",
"http://www.w3.org/ns/org#Site",
"http://www.w3.org/ns/locn#Address",
"http://www.w3.org/ns/person#Person",
"http://data.vlaanderen.be/ns/mandaat#Mandaat",
"http://data.vlaanderen.be/ns/mandaat#Mandataris",
"http://data.lblod.info/vocabularies/leidinggevenden/FunctionarisStatusCode",
"http://data.lblod.info/vocabularies/leidinggevenden/Functionaris",
"http://data.lblod.info/vocabularies/erediensten/EredienstMandataris",
"http://schema.org/ContactPoint",
"http://data.lblod.info/vocabularies/leidinggevenden/Bestuursfunctie",
"http://data.lblod.info/vocabularies/erediensten/CentraalBestuurVanDeEredienst",
"http://data.lblod.info/vocabularies/erediensten/RepresentatiefOrgaan",
]
@public_type [
"http://www.w3.org/ns/org#Role",
"http://www.w3.org/ns/org#Post",
"http://data.lblod.info/vocabularies/contacthub/AgentInPositie",
"http://data.vlaanderen.be/ns/besluit#Bestuurseenheid",
"http://xmlns.com/foaf/0.1/Person",
"http://xmlns.com/foaf/0.1/OnlineAccount",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject",
"http://www.w3.org/ns/dcat#Dataset",
"http://www.w3.org/ns/dcat#Distribution",
"http://www.w3.org/ns/dcat#Catalog",
"http://mu.semte.ch/vocabularies/ext/GeslachtCode",
"http://data.lblod.info/vocabularies/leidinggevenden/FunctionarisStatusCode",
"http://lblod.data.gift/vocabularies/organisatie/OrganisatieStatusCode",
"http://lblod.data.gift/vocabularies/organisatie/BestuursfunctieCode",
"http://lblod.data.gift/vocabularies/organisatie/BestuursorgaanClassificatieCode",
"http://lblod.data.gift/vocabularies/organisatie/TypeEredienst",
"http://lblod.data.gift/vocabularies/organisatie/HelftVerkiezing",
"http://lblod.data.gift/vocabularies/organisatie/Veranderingsgebeurtenis",
"http://lblod.data.gift/vocabularies/organisatie/VeranderingsgebeurtenisResultaat",
"http://lblod.data.gift/vocabularies/organisatie/MandatarisStatusCode",
"http://lblod.data.gift/vocabularies/organisatie/BestuurseenheidClassificatieCode",
"http://lblod.data.gift/vocabularies/organisatie/TypeEredienst",
"http://www.w3.org/2004/02/skos/core#ConceptScheme",
"http://lblod.data.gift/vocabularies/organisatie/BedienaarFinanceringCode",
"http://www.w3.org/2004/02/skos/core#Concept",
"http://publications.europa.eu/ontology/euvoc#Country",
"http://lblod.data.gift/vocabularies/organisatie/TypeVestiging",
"http://lblod.data.gift/vocabularies/organisatie/HelftVerkiezing",
"http://lblod.data.gift/vocabularies/organisatie/Veranderingsgebeurtenis",
"http://lblod.data.gift/vocabularies/organisatie/TypeBetrokkenheid",
"http://lblod.data.gift/vocabularies/organisatie/VoorwaardenBedienaarCriterium",
"http://lblod.data.gift/vocabularies/organisatie/BedienaarCriteriumBewijsstuk",
"http://lblod.data.gift/vocabularies/organisatie/EredienstBeroepen",
"http://lblod.data.gift/vocabularies/organisatie/BedienaarFinanceringCode",
"http://lblod.data.gift/vocabularies/organisatie/TypeVestiging",
"http://lblod.data.gift/vocabularies/organisatie/Rechtsvormtype",
"http://www.w3.org/2004/02/skos/core#ConceptScheme",
"http://www.w3.org/2004/02/skos/core#Concept",
"http://lblod.data.gift/vocabularies/organisatie/Rechtsvormtype"
]
@org_type [
"http://www.w3.org/ns/org#Organization",
"http://data.vlaanderen.be/ns/besluit#Besluit",
"https://data.vlaanderen.be/ns/besluitvorming#Beslissingsactiviteit",
"http://www.w3.org/ns/org#Site",
"http://www.w3.org/ns/locn#Address",
"http://www.w3.org/ns/person#Person",
"http://schema.org/ContactPoint",
"http://data.vlaanderen.be/ns/besluit#Bestuurseenheid",
"http://data.vlaanderen.be/ns/besluit#Bestuursorgaan",
"http://www.w3.org/ns/adms#Identifier",
"https://data.vlaanderen.be/ns/generiek#GestructureerdeIdentificator",
"http://data.vlaanderen.be/ns/mandaat#Mandaat",
"http://data.vlaanderen.be/ns/mandaat#Mandataris",
"http://data.lblod.info/vocabularies/leidinggevenden/Functionaris",
"http://data.lblod.info/vocabularies/leidinggevenden/Bestuursfunctie",
"http://lblod.data.gift/vocabularies/organisatie/VeranderingsgebeurtenisResultaat",
"http://www.w3.org/ns/org#Post",
"http://www.w3.org/ns/org#ChangeEvent",
"http://data.lblod.info/vocabularies/contacthub/AgentInPositie"
]
@shared_protected_type [
"http://www.w3.org/ns/prov#Location",
"http://xmlns.com/foaf/0.1/Image",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject",
"http://publications.europa.eu/ontology/euvoc#Country"
]
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
]
defp access_by_role( group_string ) do
%AccessByQuery{
# vars: ["session_group","session_role"], todo we might have to create multiple graph depending on role
vars: [],
vars: [],
query: sparql_query_for_access_role( group_string ) }
end
@@ -80,48 +97,88 @@ defmodule Acl.UserGroups.Config do
PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
SELECT distinct ?session_group ?session_role WHERE {
<SESSION_ID> ext:sessionGroup/mu:uuid ?session_group;
ext:sessionRole ?session_role.
ext:activeSessionRole ?session_role.
FILTER( ?session_role = \"#{group_string}\" )
}"
end
def user_groups do
[
%GroupSpec{
%GroupSpec{
name: "acmidm-lezer",
useage: [:read],
access: access_by_role( "ABBOrganisatiePortaalGebruiker-lezer" ),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/organisatieportaal",
graph: "http://mu.semte.ch/graphs/administrative-unit",
constraint: %ResourceConstraint{
resource_types: @protected_resource_type
resource_types: @org_type
}
}
]
},
%GroupSpec{
%GroupSpec{
name: "acmidm-editeerder",
useage: [:read, :write, :read_for_write],
access: access_by_role( "ABBOrganisatiePortaalGebruiker-editeerder" ),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/organisatieportaal",
graph: "http://mu.semte.ch/graphs/administrative-unit",
constraint: %ResourceConstraint{
resource_types: @protected_resource_type ++ @error_type
resource_types: @org_type ++ @error_type
}
}
]
},
%GroupSpec{
%GroupSpec{
name: "acmidm-beheerder",
useage: [:read, :write, :read_for_write],
access: access_by_role( "ABBOrganisatiePortaalGebruiker-beheerder" ),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/organisatieportaal",
graph: "http://mu.semte.ch/graphs/administrative-unit",
constraint: %ResourceConstraint{
resource_types: @protected_resource_type ++ @error_type
resource_types: @org_type ++ @error_type
}
}
]
},
%GroupSpec{
name: "acmidm-worship-lezer",
useage: [:read],
access: access_by_role( "ABBOrganisatiePortaalErediensten-lezer" ),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/worship-service",
constraint: %ResourceConstraint{
resource_types: @org_type ++ @worship_type
}
}
]
},
%GroupSpec{
name: "acmidm-worship-editeerder",
useage: [:read, :write, :read_for_write],
access: access_by_role( "ABBOrganisatiePortaalErediensten-editeerder" ),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/worship-service",
constraint: %ResourceConstraint{
resource_types: @org_type ++ @error_type ++ @worship_type
}
}
]
},
%GroupSpec{
name: "acmidm-worship-beheerder",
useage: [:read, :write, :read_for_write],
access: access_by_role( "ABBOrganisatiePortaalErediensten-beheerder" ),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/worship-service",
constraint: %ResourceConstraint{
resource_types: @org_type ++ @error_type ++ @worship_type
}
}
]
@@ -130,19 +187,21 @@ defmodule Acl.UserGroups.Config do
name: "public",
useage: [:read],
access: %AlwaysAccessible{},
graphs: [ %GraphSpec{
graph: "http://mu.semte.ch/graphs/public", # mock login only
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/public",
constraint: %ResourceConstraint{
resource_types: [
"http://data.vlaanderen.be/ns/besluit#Bestuurseenheid",
"http://xmlns.com/foaf/0.1/Person",
"http://xmlns.com/foaf/0.1/OnlineAccount",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject",
"http://www.w3.org/ns/dcat#Dataset",
"http://www.w3.org/ns/dcat#Distribution",
"http://www.w3.org/ns/dcat#Catalog"
]
} }]},
resource_types: @public_type
}
},
%GraphSpec{
graph: "http://mu.semte.ch/graphs/shared",
constraint: %ResourceConstraint{
resource_types: @shared_protected_type ++ @org_type
}
}
]},
# // CLEANUP
#