celest/services/celest_cloud_hub/lib/src/auth/cloud.projects.environments.cedar at ab8e95fb0a52f2eb1d032b51b06e0486d8e7e290 · celest-dev/celest · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
// Users can view project environmentss they are viewers of.
@id("cloud.projects.environments.viewer")
permit (
    principal,
    action in Celest::Action::"view",
    resource is Celest::Project::Environment
)
when
{
    (principal is Celest::Project::Member || principal is Celest::Project::Environment::Member) &&
    resource in principal.parent &&
    principal.role == Celest::Role::"viewer"
};

// Users can edit project environments they are editors of.
@id("cloud.projects.environments.editor")
permit (
    principal,
    action in Celest::Action::"edit",
    resource is Celest::Project::Environment
)
when
{
    (principal is Celest::Project::Member || principal is Celest::Project::Environment::Member) &&
    resource in principal.parent &&
    principal.role == Celest::Role::"editor"
};

// Users can do anything but delete project environments they are admins of.
@id("cloud.projects.environments.admin")
permit (
    principal,
    action in Celest::Action::"admin",
    resource is Celest::Project::Environment
)
when
{
    (principal is Celest::Project::Member || principal is Celest::Project::Environment::Member) &&
    resource in principal.parent &&
    principal.role == Celest::Role::"admin"
};

// Users can do anything to environments they are owners of.
@id("cloud.projects.environments.owner")
permit (
    principal,
    action in Celest::Action::"owner",
    resource is Celest::Project::Environment
)
when
{
    (principal is Celest::Project::Member || principal is Celest::Project::Environment::Member) &&
    resource in principal.parent &&
    principal.role == Celest::Role::"owner"
};

// Users can create environments in projects they have admin access to.
@id("cloud.projects.environments.creator")
permit (
    principal,
    action == Celest::Action::"create",
    resource is Celest::Project::Environment
)
when
{
    (principal is Celest::Project::Member || principal is Celest::Project::Environment::Member) &&
    resource in principal.parent &&
    principal.role in Celest::Role::"admin"
};

// Members can deploy environments in projects they have deploy or admin access to.
@id("cloud.projects.environments.deployer")
permit (
    principal,
    action == Celest::Action::"deploy",
    resource is Celest::Project::Environment
)
when
{
    (principal is Celest::Project::Member || principal is Celest::Project::Environment::Member) &&
    resource in principal.parent &&
    principal.role in Celest::Role::"admin"
};