felix.ruizdearcaute/app-organization-portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
539376c47c6cc8aef21c3e88721b9ce65049950b
app-organization-portal/config/authorization/config.ex
Sam Van Campenhout b97b545add Set up the jobs dashboard 
Based on the same setup in the worship decisions app: https://github.com/lblod/app-worship-decisions-database/pull/29
2025-03-20 09:32:09 +01:00

273 lines
11 KiB
Elixir
Raw Blame History

alias Acl.Accessibility.Always, as: AlwaysAccessible
alias Acl.GraphSpec.Constraint.Resource, as: ResourceConstraint
alias Acl.GraphSpec.Constraint.ResourceFormat, as: ResourceFormatConstraint
alias Acl.Accessibility.ByQuery, as: AccessByQuery
alias Acl.GraphSpec, as: GraphSpec
alias Acl.GroupSpec, as: GroupSpec
alias Acl.GroupSpec.GraphCleanup, as: GraphCleanup
defmodule Acl.UserGroups.Config do
@error_type [
"https://docs.oasis-open-projects.org/oslc-op/core/v3.0/os/core-vocab.html#Error"
]
@worship_type [
"http://data.lblod.info/vocabularies/erediensten/EredienstMandataris",
"http://data.lblod.info/vocabularies/erediensten/BestuurVanDeEredienst",
"http://data.lblod.info/vocabularies/erediensten/EredienstBestuurseenheid",
"http://data.lblod.info/vocabularies/erediensten/RolBedienaar",
"http://data.lblod.info/vocabularies/erediensten/VoorwaardenBedienaar",
"http://data.lblod.info/vocabularies/erediensten/PositieBedienaar",
"http://data.lblod.info/vocabularies/erediensten/BetrokkenLokaleBesturen",
"http://data.lblod.info/vocabularies/erediensten/VerbondenJuridischeStructuren",
"http://data.lblod.info/vocabularies/erediensten/CentraalBestuurVanDeEredienst",
"http://data.lblod.info/vocabularies/erediensten/RepresentatiefOrgaan"
]
@public_type [
"http://www.w3.org/ns/org#Role",
"http://data.vlaanderen.be/ns/besluit#Bestuurseenheid",
"http://xmlns.com/foaf/0.1/Person",
"http://xmlns.com/foaf/0.1/OnlineAccount",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject",
"http://www.w3.org/ns/dcat#Dataset",
"http://www.w3.org/ns/dcat#Distribution",
"http://www.w3.org/ns/dcat#Catalog",
"http://mu.semte.ch/vocabularies/ext/GeslachtCode",
"http://data.lblod.info/vocabularies/leidinggevenden/FunctionarisStatusCode",
"http://lblod.data.gift/vocabularies/organisatie/OrganisatieStatusCode",
"http://lblod.data.gift/vocabularies/organisatie/BestuursfunctieCode",
"http://lblod.data.gift/vocabularies/organisatie/BestuursorgaanClassificatieCode",
"http://lblod.data.gift/vocabularies/organisatie/MandatarisStatusCode",
"http://lblod.data.gift/vocabularies/organisatie/BestuurseenheidClassificatieCode",
"http://mu.semte.ch/vocabularies/ext/GeregistreerdeOrganisatieClassificatieCode",
"http://lblod.data.gift/vocabularies/organisatie/TypeEredienst",
"http://www.w3.org/2004/02/skos/core#ConceptScheme",
"http://lblod.data.gift/vocabularies/organisatie/BedienaarFinancieringCode",
"http://www.w3.org/2004/02/skos/core#Concept",
"http://publications.europa.eu/ontology/euvoc#Country",
"http://lblod.data.gift/vocabularies/organisatie/TypeVestiging",
"http://lblod.data.gift/vocabularies/organisatie/HelftVerkiezing",
"http://lblod.data.gift/vocabularies/organisatie/Veranderingsgebeurtenis",
"http://lblod.data.gift/vocabularies/organisatie/TypeBetrokkenheid",
"http://lblod.data.gift/vocabularies/organisatie/VoorwaardenBedienaarCriterium",
"http://lblod.data.gift/vocabularies/organisatie/BedienaarCriteriumBewijsstuk",
"http://lblod.data.gift/vocabularies/organisatie/EredienstBeroepen",
"http://lblod.data.gift/vocabularies/organisatie/Rechtsvormtype"
]
@org_type [
"http://purl.org/dc/terms/Agent",
"http://www.w3.org/ns/org#Organization",
"http://www.w3.org/ns/regorg#RegisteredOrganization",
"http://data.vlaanderen.be/ns/besluit#Besluit",
"https://data.vlaanderen.be/ns/besluitvorming#Beslissingsactiviteit",
"http://www.w3.org/ns/org#Site",
"http://www.w3.org/ns/locn#Address",
"http://www.w3.org/ns/person#Person",
"http://schema.org/ContactPoint",
"http://data.vlaanderen.be/ns/besluit#Bestuurseenheid",
"http://data.vlaanderen.be/ns/besluit#Bestuursorgaan",
"http://www.w3.org/ns/adms#Identifier",
"https://data.vlaanderen.be/ns/generiek#GestructureerdeIdentificator",
"http://data.vlaanderen.be/ns/mandaat#Mandaat",
"http://data.vlaanderen.be/ns/mandaat#Mandataris",
"http://data.lblod.info/vocabularies/leidinggevenden/Functionaris",
"http://data.lblod.info/vocabularies/leidinggevenden/Bestuursfunctie",
"http://lblod.data.gift/vocabularies/organisatie/VeranderingsgebeurtenisResultaat",
"http://www.w3.org/ns/org#Post",
"http://www.w3.org/ns/org#ChangeEvent",
"http://data.lblod.info/vocabularies/contacthub/AgentInPositie",
"http://mu.semte.ch/vocabularies/ext/KboOrganisatie",
"http://www.w3.org/ns/org#Membership",
"http://www.w3.org/2006/time#ProperInterval"
]
@shared_protected_type [
"http://www.w3.org/ns/prov#Location",
"http://xmlns.com/foaf/0.1/Image",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
]
defp access_by_role(group_string) do
%AccessByQuery{
# vars: ["session_group","session_role"], todo we might have to create multiple graph depending on role
vars: [],
query: sparql_query_for_access_role(group_string)
}
end
defp sparql_query_for_access_role(group_string) do
"PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
SELECT distinct ?session_group ?session_role WHERE {
<SESSION_ID> ext:sessionGroup/mu:uuid ?session_group;
ext:activeSessionRole ?session_role.
FILTER( ?session_role = \"#{group_string}\" )
}"
end
defp can_access_dashboard() do
%AccessByQuery{
vars: [],
query: "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
SELECT DISTINCT ?account WHERE {
<SESSION_ID> <http://mu.semte.ch/vocabularies/session/account> ?account.
?account <http://mu.semte.ch/vocabularies/ext/sessionRole> ?session_role.
FILTER( ?session_role = \"dashboard-user\" )
}"
}
end
def user_groups do
[
%GroupSpec{
name: "acmidm-lezer",
useage: [:read],
access: access_by_role("ABBOrganisatiePortaalGebruiker-lezer"),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/administrative-unit",
constraint: %ResourceConstraint{
resource_types: @org_type
}
}
]
},
%GroupSpec{
name: "acmidm-editeerder",
useage: [:read, :write, :read_for_write],
access: access_by_role("ABBOrganisatiePortaalGebruiker-editeerder"),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/administrative-unit",
constraint: %ResourceConstraint{
resource_types: @org_type ++ @error_type
}
}
]
},
%GroupSpec{
name: "acmidm-beheerder",
useage: [:read, :write, :read_for_write],
access: access_by_role("ABBOrganisatiePortaalGebruiker-beheerder"),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/administrative-unit",
constraint: %ResourceConstraint{
resource_types: @org_type ++ @error_type
}
}
]
},
%GroupSpec{
name: "acmidm-worship-lezer",
useage: [:read],
access: access_by_role("ABBOrganisatiePortaalErediensten-lezer"),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/worship-service",
constraint: %ResourceConstraint{
resource_types: @org_type ++ @worship_type
}
}
]
},
%GroupSpec{
name: "acmidm-worship-editeerder",
useage: [:read, :write, :read_for_write],
access: access_by_role("ABBOrganisatiePortaalErediensten-editeerder"),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/worship-service",
constraint: %ResourceConstraint{
resource_types: @org_type ++ @error_type ++ @worship_type
}
}
]
},
%GroupSpec{
name: "acmidm-worship-beheerder",
useage: [:read, :write, :read_for_write],
access: access_by_role("ABBOrganisatiePortaalErediensten-beheerder"),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/worship-service",
constraint: %ResourceConstraint{
resource_types: @org_type ++ @error_type ++ @worship_type
}
}
]
},
%GroupSpec{
name: "public",
useage: [:read],
access: %AlwaysAccessible{},
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/public",
constraint: %ResourceConstraint{
resource_types: @public_type
}
},
%GraphSpec{
graph: "http://mu.semte.ch/graphs/shared",
constraint: %ResourceConstraint{
resource_types: @shared_protected_type ++ @org_type
}
}
]
},
# // dashboard users
%GroupSpec{
name: "dashboard-users",
useage: [:read],
access: can_access_dashboard(),
graphs: [
%GraphSpec{
graph: "http://mu.semte.ch/graphs/reports",
constraint: %ResourceConstraint{
resource_types: [
"http://lblod.data.gift/vocabularies/reporting/Report",
"http://open-services.net/ns/core#Error",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#DataContainer",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
]
}
},
%GraphSpec{
graph: "http://mu.semte.ch/graphs/system/jobs",
constraint: %ResourceConstraint{
resource_types: [
"http://vocab.deri.ie/cogs#Job",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#DataContainer",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
]
}
},
# OP stores jobs in multiple graphs, so we configure both until they are merged into one graph
%GraphSpec{
graph: "http://mu.semte.ch/graphs/jobs",
constraint: %ResourceConstraint{
resource_types: [
"http://vocab.deri.ie/cogs#Job",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#DataContainer",
"http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
]
}
},
]
},
# // CLEANUP
#
%GraphCleanup{
originating_graph: "http://mu.semte.ch/application",
useage: [:read, :write],
name: "clean"
}
]
end
end
Reference in New Issue View Git Blame Copy Permalink