Skip to content

Commit c71b43a

Browse files
author
Andre Turner
committed
schema changes after ap inject
1 parent e7d3f9c commit c71b43a

23 files changed

+989
-0
lines changed

‎dbschema/budget.esdl‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,23 @@ module default {
77
universalTemplate: File;
88

99
records := .<budget[is Budget::Record];
10+
11+
access policy CanSelectUpdateReadGeneratedFromAppPoliciesForBudget
12+
allow select, update read using (
13+
(
14+
exists (<Role>{'Administrator', 'FieldOperationsDirector', 'LeadFinancialAnalyst', 'Controller', 'FinancialAnalyst', 'Marketing', 'Fundraising', 'ExperienceOperations', 'Leadership', 'ProjectManager', 'RegionalDirector'} intersect global currentRoles)
15+
or (
16+
Role.ConsultantManager in global currentRoles
17+
and (
18+
.isMember
19+
or .sensitivity <= Sensitivity.Medium
20+
)
21+
)
22+
)
23+
);
24+
25+
access policy CanUpdateWriteInsertDeleteGeneratedFromAppPoliciesForBudget
26+
allow update write, insert, delete;
1027
}
1128
}
1229

@@ -29,6 +46,23 @@ module Budget {
2946
readonly := true;
3047
on target delete delete source;
3148
};
49+
50+
access policy CanSelectUpdateReadGeneratedFromAppPoliciesForBudgetRecord
51+
allow select, update read using (
52+
(
53+
exists (<default::Role>{'Administrator', 'FieldOperationsDirector', 'LeadFinancialAnalyst', 'Controller', 'FinancialAnalyst', 'Marketing', 'Fundraising', 'ExperienceOperations', 'Leadership', 'ProjectManager', 'RegionalDirector'} intersect global default::currentRoles)
54+
or (
55+
default::Role.ConsultantManager in global default::currentRoles
56+
and (
57+
.isMember
58+
or .sensitivity <= default::Sensitivity.Medium
59+
)
60+
)
61+
)
62+
);
63+
64+
access policy CanUpdateWriteInsertDeleteGeneratedFromAppPoliciesForBudgetRecord
65+
allow update write, insert, delete;
3266
}
3367

3468
scalar type Status extending enum<

‎dbschema/ceremony.esdl‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,20 @@ module Engagement {
77
actualDate: cal::local_date;
88

99
constraint exclusive on (.engagement);
10+
11+
access policy CanSelectUpdateReadGeneratedFromAppPoliciesForCeremony
12+
allow select, update read using (
13+
(
14+
exists (<default::Role>{'Administrator', 'FieldOperationsDirector', 'FieldPartner', 'FinancialAnalyst', 'LeadFinancialAnalyst', 'Controller', 'Marketing', 'Fundraising', 'ExperienceOperations', 'Leadership', 'ProjectManager', 'RegionalDirector', 'StaffMember'} intersect global default::currentRoles)
15+
or (
16+
exists (<default::Role>{'Consultant', 'ConsultantManager', 'Intern', 'Mentor', 'Translator'} intersect global default::currentRoles)
17+
and .isMember
18+
)
19+
)
20+
);
21+
22+
access policy CanUpdateWriteInsertDeleteGeneratedFromAppPoliciesForCeremony
23+
allow update write, insert, delete;
1024
}
1125
type DedicationCeremony extending Ceremony {}
1226
type CertificationCeremony extending Ceremony {}

‎dbschema/comments.esdl‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,19 @@
11
module Comments {
22
abstract type Aware extending default::Resource {
33
commentThreads := .<container[is Thread];
4+
5+
access policy CanSelectUpdateReadGeneratedFromAppPoliciesForCommentable
6+
allow select, update read using (
7+
exists (<default::Role>{'Administrator', 'Leadership'} intersect global default::currentRoles)
8+
);
9+
10+
access policy CanUpdateWriteGeneratedFromAppPoliciesForCommentable
11+
allow update write;
12+
13+
access policy CanInsertDeleteGeneratedFromAppPoliciesForCommentable
14+
allow insert, delete using (
15+
default::Role.Administrator in global default::currentRoles
16+
);
417
}
518

619
type Thread extending default::Resource, Mixin::Embedded {
@@ -10,12 +23,60 @@ module Comments {
1023
comments := .<thread[is Comment];
1124
firstComment := (select .comments order by .createdAt asc limit 1);
1225
latestComment := (select .comments order by .createdAt desc limit 1);
26+
27+
access policy CanSelectUpdateReadGeneratedFromAppPoliciesForCommentThread
28+
allow select, update read using (
29+
(
30+
exists (<default::Role>{'Administrator', 'Leadership'} intersect global default::currentRoles)
31+
or .isCreator
32+
)
33+
);
34+
35+
access policy CanUpdateWriteGeneratedFromAppPoliciesForCommentThread
36+
allow update write;
37+
38+
access policy CanInsertGeneratedFromAppPoliciesForCommentThread
39+
allow insert using (
40+
default::Role.Administrator in global default::currentRoles
41+
);
42+
43+
access policy CanDeleteGeneratedFromAppPoliciesForCommentThread
44+
allow delete using (
45+
(
46+
default::Role.Administrator in global default::currentRoles
47+
or .isCreator
48+
)
49+
);
1350
}
1451

1552
type Comment extending default::Resource {
1653
required thread: Thread {
1754
on target delete delete source;
1855
};
1956
required body: default::RichText;
57+
58+
access policy CanSelectUpdateReadGeneratedFromAppPoliciesForComment
59+
allow select, update read using (
60+
(
61+
exists (<default::Role>{'Administrator', 'Leadership'} intersect global default::currentRoles)
62+
or .isCreator
63+
)
64+
);
65+
66+
access policy CanUpdateWriteGeneratedFromAppPoliciesForComment
67+
allow update write;
68+
69+
access policy CanInsertGeneratedFromAppPoliciesForComment
70+
allow insert using (
71+
default::Role.Administrator in global default::currentRoles
72+
);
73+
74+
access policy CanDeleteGeneratedFromAppPoliciesForComment
75+
allow delete using (
76+
(
77+
default::Role.Administrator in global default::currentRoles
78+
or .isCreator
79+
)
80+
);
2081
}
2182
}

‎dbschema/engagement.esdl‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,44 @@ module default {
4747
};
4848

4949
description: RichText;
50+
51+
access policy CanSelectUpdateReadGeneratedFromAppPoliciesForEngagement
52+
allow select, update read using (
53+
(
54+
exists (<Role>{'Administrator', 'ProjectManager', 'RegionalDirector', 'FieldOperationsDirector', 'FinancialAnalyst', 'LeadFinancialAnalyst', 'Controller', 'Marketing', 'Fundraising', 'ExperienceOperations', 'Leadership', 'StaffMember'} intersect global currentRoles)
55+
or (
56+
exists (<Role>{'Consultant', 'ConsultantManager', 'FieldPartner', 'Intern', 'Mentor', 'ProjectManager', 'RegionalDirector', 'FieldOperationsDirector', 'Translator'} intersect global currentRoles)
57+
and .isMember
58+
)
59+
)
60+
);
61+
62+
access policy CanUpdateWriteGeneratedFromAppPoliciesForEngagement
63+
allow update write;
64+
65+
access policy CanInsertGeneratedFromAppPoliciesForEngagement
66+
allow insert using (
67+
(
68+
Role.Administrator in global currentRoles
69+
or (
70+
exists (<Role>{'ProjectManager', 'RegionalDirector', 'FieldOperationsDirector', 'FinancialAnalyst', 'LeadFinancialAnalyst', 'Controller'} intersect global currentRoles)
71+
and .isMember
72+
and <str>.project.status = 'InDevelopment'
73+
)
74+
)
75+
);
76+
77+
access policy CanDeleteGeneratedFromAppPoliciesForEngagement
78+
allow delete using (
79+
(
80+
Role.Administrator in global currentRoles
81+
or (
82+
exists (<Role>{'ProjectManager', 'RegionalDirector', 'FieldOperationsDirector', 'FinancialAnalyst', 'LeadFinancialAnalyst', 'Controller'} intersect global currentRoles)
83+
and .isMember
84+
and <str>.status = 'InDevelopment'
85+
)
86+
)
87+
);
5088
}
5189

5290
type LanguageEngagement extending Engagement {
@@ -119,6 +157,11 @@ module default {
119157
update __old__.language.projectContext
120158
set { projects -= __old__.project }
121159
);
160+
161+
access policy CanSelectUpdateReadGeneratedFromAppPoliciesForLanguageEngagement
162+
allow select, update read using (
163+
Role.ConsultantManager in global currentRoles
164+
);
122165
}
123166

124167
type InternshipEngagement extending Engagement {

‎dbschema/field-region.esdl‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,18 @@ module default {
66

77
required fieldZone: FieldZone;
88
required director: User;
9+
10+
access policy CanSelectUpdateReadGeneratedFromAppPoliciesForFieldRegion
11+
allow select, update read using (
12+
exists (<Role>{'Administrator', 'Consultant', 'ConsultantManager', 'FieldPartner', 'FinancialAnalyst', 'LeadFinancialAnalyst', 'Controller', 'Marketing', 'Fundraising', 'ExperienceOperations', 'Leadership', 'ProjectManager', 'RegionalDirector', 'FieldOperationsDirector', 'StaffMember'} intersect global currentRoles)
13+
);
14+
15+
access policy CanUpdateWriteGeneratedFromAppPoliciesForFieldRegion
16+
allow update write;
17+
18+
access policy CanInsertDeleteGeneratedFromAppPoliciesForFieldRegion
19+
allow insert, delete using (
20+
Role.Administrator in global currentRoles
21+
);
922
}
1023
}

‎dbschema/field-zone.esdl‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,18 @@ module default {
77
required director: User;
88

99
fieldRegions := .<fieldZone[is FieldRegion];
10+
11+
access policy CanSelectUpdateReadGeneratedFromAppPoliciesForFieldZone
12+
allow select, update read using (
13+
exists (<Role>{'Administrator', 'Consultant', 'ConsultantManager', 'FieldPartner', 'FinancialAnalyst', 'LeadFinancialAnalyst', 'Controller', 'Marketing', 'Fundraising', 'ExperienceOperations', 'Leadership', 'ProjectManager', 'RegionalDirector', 'FieldOperationsDirector', 'StaffMember'} intersect global currentRoles)
14+
);
15+
16+
access policy CanUpdateWriteGeneratedFromAppPoliciesForFieldZone
17+
allow update write;
18+
19+
access policy CanInsertDeleteGeneratedFromAppPoliciesForFieldZone
20+
allow insert, delete using (
21+
Role.Administrator in global currentRoles
22+
);
1023
}
1124
}

‎dbschema/file.esdl‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,11 @@ module default {
44
required totalFiles: int32 {
55
default := 0;
66
};
7+
8+
access policy CanSelectUpdateReadGeneratedFromAppPoliciesForDirectory
9+
allow select, update read using (
10+
exists (<Role>{'FinancialAnalyst', 'LeadFinancialAnalyst', 'Controller'} intersect global currentRoles)
11+
);
712
}
813

914
# TODO how to front latest version info?
@@ -38,5 +43,18 @@ module File {
3843
depth: int16; # todo enforce
3944
}
4045
# multi link children: Node;
46+
47+
access policy CanSelectUpdateReadGeneratedFromAppPoliciesForFileNode
48+
allow select, update read using (
49+
exists (<default::Role>{'Administrator', 'Leadership'} intersect global default::currentRoles)
50+
);
51+
52+
access policy CanUpdateWriteGeneratedFromAppPoliciesForFileNode
53+
allow update write;
54+
55+
access policy CanInsertDeleteGeneratedFromAppPoliciesForFileNode
56+
allow insert, delete using (
57+
default::Role.Administrator in global default::currentRoles
58+
);
4159
}
4260
}

‎dbschema/funding-account.esdl‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,18 @@ module default {
77
required accountNumber: int16 {
88
constraint expression on (__subject__ >= 0 and __subject__ <= 9);
99
}
10+
11+
access policy CanSelectUpdateReadGeneratedFromAppPoliciesForFundingAccount
12+
allow select, update read using (
13+
exists (<Role>{'Administrator', 'ConsultantManager', 'FinancialAnalyst', 'LeadFinancialAnalyst', 'Controller', 'Leadership', 'ProjectManager', 'RegionalDirector', 'FieldOperationsDirector', 'StaffMember'} intersect global currentRoles)
14+
);
15+
16+
access policy CanUpdateWriteGeneratedFromAppPoliciesForFundingAccount
17+
allow update write;
18+
19+
access policy CanInsertDeleteGeneratedFromAppPoliciesForFundingAccount
20+
allow insert, delete using (
21+
Role.Administrator in global currentRoles
22+
);
1023
}
1124
}

‎dbschema/language.esdl‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,25 @@ module default {
8787
}
8888

8989
index on ((.name, .ownSensitivity, .leastOfThese, .isSignLanguage, .isDialect));
90+
91+
access policy CanSelectUpdateReadGeneratedFromAppPoliciesForLanguage
92+
allow select, update read using (
93+
(
94+
exists (<Role>{'Administrator', 'ConsultantManager', 'ExperienceOperations', 'LeadFinancialAnalyst', 'Controller', 'FinancialAnalyst', 'Fundraising', 'Marketing', 'Leadership', 'ProjectManager', 'RegionalDirector', 'FieldOperationsDirector', 'StaffMember'} intersect global currentRoles)
95+
or (
96+
exists (<Role>{'Consultant', 'ConsultantManager', 'FieldPartner', 'Intern', 'Mentor', 'Translator'} intersect global currentRoles)
97+
and .isMember
98+
)
99+
)
100+
);
101+
102+
access policy CanUpdateWriteGeneratedFromAppPoliciesForLanguage
103+
allow update write;
104+
105+
access policy CanInsertDeleteGeneratedFromAppPoliciesForLanguage
106+
allow insert, delete using (
107+
Role.Administrator in global currentRoles
108+
);
90109
}
91110

92111
scalar type population extending int32 {
@@ -109,6 +128,40 @@ module Ethnologue {
109128
};
110129
name: str;
111130
population: default::population;
131+
132+
access policy CanSelectUpdateReadGeneratedFromAppPoliciesForEthnologueLanguage
133+
allow select, update read using (
134+
(
135+
exists (<default::Role>{'Administrator', 'ExperienceOperations', 'Leadership', 'ProjectManager', 'RegionalDirector', 'FieldOperationsDirector'} intersect global default::currentRoles)
136+
or (
137+
default::Role.ConsultantManager in global default::currentRoles
138+
and .sensitivity <= default::Sensitivity.Medium
139+
)
140+
or (
141+
exists (<default::Role>{'Consultant', 'ConsultantManager', 'FieldPartner', 'Translator'} intersect global default::currentRoles)
142+
and .isMember
143+
)
144+
or (
145+
default::Role.Fundraising in global default::currentRoles
146+
and (
147+
.isMember
148+
or .sensitivity <= default::Sensitivity.Medium
149+
)
150+
)
151+
or (
152+
exists (<default::Role>{'Marketing', 'Fundraising', 'ExperienceOperations'} intersect global default::currentRoles)
153+
and .sensitivity <= default::Sensitivity.Low
154+
)
155+
)
156+
);
157+
158+
access policy CanUpdateWriteGeneratedFromAppPoliciesForEthnologueLanguage
159+
allow update write;
160+
161+
access policy CanInsertDeleteGeneratedFromAppPoliciesForEthnologueLanguage
162+
allow insert, delete using (
163+
default::Role.Administrator in global default::currentRoles
164+
);
112165
}
113166

114167
scalar type code extending str {

‎dbschema/location.esdl‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,14 @@ module default {
1313
defaultFieldRegion: FieldRegion;
1414
defaultMarketingRegion: Location;
1515
mapImage: File;
16+
17+
access policy CanSelectUpdateReadUpdateWriteGeneratedFromAppPoliciesForLocation
18+
allow select, update read, update write;
19+
20+
access policy CanInsertDeleteGeneratedFromAppPoliciesForLocation
21+
allow insert, delete using (
22+
Role.Administrator in global currentRoles
23+
);
1624
}
1725
}
1826

0 commit comments

Comments
 (0)