permissions.acl

/*
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

//General Customer and viewing permissions
rule PatientViewOwnDrugs {
    description: "Allow Patients to view owned drugs"
    participant(p): "org.drugs.Patient"
    operation: READ
    resource(d): "org.drugs.Drug"
    condition: (d.owner.getIdentifier() == p.getIdentifier())
    action: ALLOW
}

rule CustomersViewDrugs {
    description: "Allow Customers to view valid and available drugs"
    participant(p): "org.drugs.Customer"
    operation: READ
    resource(d): "org.drugs.Drug"
    condition: (d.drugStatus != "SOLD")
    action: ALLOW
}

rule CustomerReceiveDrugs {
  description: "Allow Customers to execute the receive transaction"
  participant(p): "org.drugs.Customer"
  operation: CREATE
  resource(r): "org.drugs.ReceiveDrug"
  condition: (r.customer.getIdentifier() == p.getIdentifier())
  action: ALLOW
}

//we only allow Pharmacists to view the drugs they have sold. 
//Distributers don't need to know what patient has consumed a drug (patient safety)
//A pharmacists needs to have a log of drugs a patient has taken to make sure the patient doesn't take drugs that are not compatible
rule PharmacistViewSoldDrugs {
  description: "Allow a Pharmacists to view the drugs he sold"
  participant(p): "org.drugs.Pharmacist"
  operation: READ
  resource(d): "org.drugs.Drug"
  condition: (d.pharmacist.getIdentifier() == p.getIdentifier())
  action: ALLOW
}


//verification
//add condition to make sure nobody impersonates someone
rule CustomersVerifyDrugs {
  description: "Allow customers to validate drugs"
  participant(p): "org.drugs.Customer"
  operation: READ, CREATE
  resource(v): "org.drugs.VerifyDrug"
  condition: (v.verifier.getIdentifier()==p.getIdentifier())
  action: ALLOW
}

rule CustomersVerifyDrugs2 {
    description: "Allow customers to verify drugs"
    participant(p): "org.drugs.Customer"
    operation: UPDATE
    resource(d): "org.drugs.Drug"
    transaction(tx): "org.drugs.VerifyDrug"
    condition: (tx.verifier.getIdentifier() == p.getIdentifier())
    action: ALLOW
}

//Buying rules
rule PatientBuyDrugs {
    description: "Allow Patients to buy valid Drugs from the pharmacist"
    participant(p): "org.drugs.Patient"
    operation: UPDATE
    resource(d): "org.drugs.Drug"
    transaction(tx): "org.drugs.ReceiveDrug"
    condition: (d.drugTransactionStatus == "PHARMA" && d.drugStatus=="VALID")
    action: ALLOW
}

//Pharmacy permissions
rule PharmacistBuyDrugs {
    description: "Allow Pharmacist to buy valid Drugs from the Distributer"
    participant(p): "org.drugs.Pharmacist"
    operation: CREATE, READ, UPDATE
    resource(d): "org.drugs.Drug"
    transaction(tx): "org.drugs.ReceiveDrug"
    condition: (d.drugStatus=="VALID" && d.drugTransactionStatus == "DISTRIBUTED")
    action: ALLOW
}

//Distributer permissions
/*rule DistributerReceiveDrugs {
  description: "Allow Distributers to execute the receive transaction"
  participant(p): "org.drugs.Distributer"
  operation: CREATE
  resource(r): "org.drugs.ReceiveDrug"
  condition: (r.customer.getIdentifier() == p.getIdentifier())
  action: ALLOW
}*/

rule DistributerBuyDrugs {
    description: "Allow Distributer to buy valid Drugs from the Manufacturer"
    participant(p): "org.drugs.Distributer"
    operation: CREATE, READ, UPDATE
    resource(d): "org.drugs.Drug"
    transaction(tx): "org.drugs.ReceiveDrug"
    condition: (d.drugStatus=="VALID" && d.drugTransactionStatus == "CREATED")
    action: ALLOW
}

//Manufacturer permissions
rule ManufacturerCreateDrugs {
    description: "Allow manufacturers to create and view their Drugs"
    participant(m): "org.drugs.Manufacturer"
    operation: CREATE
    resource(cd): "org.drugs.CreateDrug"
    condition: (cd.metaData.manufacturer.getIdentifier() == m.getIdentifier())
    action: ALLOW
}

rule ManufacturerReadDrugs {
    description: "Allow manufacturers to create drugs"
    participant(m): "org.drugs.Manufacturer"
    operation: CREATE
    resource(d): "org.drugs.Drug"
    condition: (d.metaData.manufacturer.getIdentifier() == m.getIdentifier())
    action: ALLOW
}

rule ManufacturerViewDrugs {
    description: "Allow manufacturers to view all unsold drugs"
    participant(m): "org.drugs.Manufacturer"
    operation: READ
    resource(d): "org.drugs.Drug"
    condition: (d.drugStatus != "SOLD")
    action: ALLOW
}


rule ManufacturerDenyViewPatient {
    description: "Deny manufacturers to see Patients"
    participant: "org.drugs.Manufacturer"
    operation: READ
    resource: "org.drugs.Patient"
    action: DENY
}

rule DistributerDenyViewPatient {
    description: "Deny Distributer to see Patients"
    participant: "org.drugs.Distributer"
    operation: READ
    resource: "org.drugs.Patient"
    action: DENY
}

rule PatientDenyViewPatient {
    description: "Deny Patient to see other Patients"
    participant(p): "org.drugs.Patient"
    operation: READ
    resource(r): "org.drugs.Patient"
    condition: (p.getIdentifier() != r.getIdentifier())
    action: DENY
}

rule ParticipantsSeeOthers {
    description: "Let participants see other participants"
    participant: "org.hyperledger.composer.system.Participant"
    operation: READ
    resource: "org.hyperledger.composer.system.Participant"
    action: ALLOW
}

//system permissions
rule ParticipantsSeeSelves {
    description: "Let participants see themselves"
    participant(p): "org.hyperledger.composer.system.Participant"
    operation: ALL
    resource(r): "org.hyperledger.composer.system.Participant"
    condition: (r.getIdentifier() == p.getIdentifier())
    action: ALLOW
}


rule NetworkAdminUser {
    description: "Grant business network administrators full access to user resources"
    participant: "org.hyperledger.composer.system.NetworkAdmin"
    operation: ALL
    resource: "**"
    action: ALLOW
}


rule System {
    description: "Grant all full access to system resources"
    participant: "org.**"
    operation: ALL
    resource: "org.hyperledger.composer.system.**"
    action: ALLOW
}