﻿<?xml version="1.0" encoding="UTF-8"?>
<Policy  PolicyId="dean"
         xmlns="urn:oasis:names:tc:xacml:1.0:policy"
         xmlns:context="urn:oasis:names:tc:xacml:1.0:context"
         xmlns:db="db_acad"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">

  <Description>
   A dean can view marks
   of another student for
   purpose GradeSheetEvaluation once.
   Once he has succesfully been allowed
   to view the marks, the student must
   be informed through email, and the
   permit for viewing marks for that student 
   should be taken away.
   </Description>

  <PolicyDefaults>
    <XPathVersion>http://www.w3.org/TR/1999/Rec-xpath-19991116</XPathVersion>
  </PolicyDefaults>
  <!--
  #The policy is applicable to the Role: Dean
  #Action: View
  #Resources: sub1, sub2, sub3
  #Purpose: GradeSheetEvaluation  
  -->
  <Target>

    <Subjects>
      <Subject>
        <SubjectMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dean</AttributeValue>
          <SubjectAttributeDesignator AttributeId="db_acad_users_user_role" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true" />
        </SubjectMatch>
      </Subject>
    </Subjects>

    <Actions>
      <Action>
        <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">view</AttributeValue>
          <ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" />
        </ActionMatch>
      </Action>
    </Actions>

    <Resources>

      <Resource>
        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">sub1</AttributeValue>
          <ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false" />
        </ResourceMatch>
      </Resource>

      <Resource>
        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">sub2</AttributeValue>
          <ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" />
        </ResourceMatch>
      </Resource>

      <Resource>
        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">sub3</AttributeValue>
          <ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" />
        </ResourceMatch>
      </Resource>

      <Resource>
        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">GradeSheetEvaluation</AttributeValue>
          <ResourceAttributeDesignator AttributeId="policy_purpose" DataType="http://www.w3.org/2001/XMLSchema#string"/>
        </ResourceMatch>
      </Resource>

    </Resources>

  </Target>

  <Rule Effect="Permit" RuleId="PermitIfViewNotHappened">

   <!--
      Dean can access information only 
      if he hasnt viewed them before. 
    -->  
  
    
    <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
      <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">false</AttributeValue>
      
      <AttributeSelector RequestContextPath="//context:ResourceContent/db:user/db:dean_view_once/text()" DataType="http://www.w3.org/2001/XMLSchema#string"/>
    </Condition>

  </Rule>

  <Rule Effect="Deny" RuleId="DenyOtherwise" />

  <Obligations>
    
    <!-- 
    The Student must be informed that
    his marks have been viewed by the
    Dean.
    -->
    <Obligation ObligationId="email" FulfillOn="Permit">
      <AttributeAssignment AttributeId="mailto" DataType="http://www.w3.org/2001/XMLSchema#string">
        //context:ResourceContent/db:user/db:email/text()
      </AttributeAssignment>
      <AttributeAssignment AttributeId="text" DataType="http://www.w3.org/2001/XMLSchema#string">
        Your marks have been accessed by the Dean for the purpose of Creation of GradeSheet.
      </AttributeAssignment>
    </Obligation>
    
    <!--
    Since the Dean has now been permitted
    to view the marks, the permit should now
    be changed to false. Or in another words
    now the dean cannot view these marks again.
    -->

    <Obligation ObligationId="updatedean_view_once" FulfillOn="Permit">
      <AttributeAssignment AttributeId="dean_view_once" DataType="http://www.w3.org/2001/XMLSchema#string">true</AttributeAssignment>
      <AttributeAssignment AttributeId="db_acad_users_user_username" DataType="http://www.w3.org/2001/XMLSchema#string">
        <AttributeSelector RequestContextPath="//context:ResourceContent/db:user/db:username/text()" DataType="http://www.w3.org/2001/XMLSchema#string"/>
      </AttributeAssignment>
    </Obligation>
  </Obligations>
  
  
</Policy>
