﻿<?xml version="1.0" encoding="UTF-8"?>
<Policy  PolicyId="head"
         xmlns="urn:oasis:names:tc:xacml:1.0:policy"
         xmlns:context="urn:oasis:names:tc:xacml:1.0:context"
         xmlns:db="db_acad"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">

  <Description>
    A head can view the marks of the subject of only his branch for moderation purpose.
  </Description>

  <PolicyDefaults>
    <XPathVersion>http://www.w3.org/TR/1999/Rec-xpath-19991116</XPathVersion>
  </PolicyDefaults>

  <Target>

    <!--
    #Policy is meant for the role Head
    #Policy Applicable only when subject wants to view Information
    #Policy is applicable when resources to be accessed are sub1, sub2, sub3.
    #Policy is applicable when purpose for viewing data is moderation.
    -->
    <Subjects>
      <Subject>
        <SubjectMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">head</AttributeValue>
          <SubjectAttributeDesignator AttributeId="db_acad_users_user_role" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true" />
        </SubjectMatch>
      </Subject>
    </Subjects>

    
    <Actions>
      <Action>
        <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">view</AttributeValue>
          <ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" />
        </ActionMatch>
      </Action>
    </Actions>

    <Resources>

      <Resource>
        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">sub1</AttributeValue>
          <ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false" />
        </ResourceMatch>
      </Resource>

      <Resource>
        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">sub2</AttributeValue>
          <ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" />
        </ResourceMatch>
      </Resource>

      <Resource>
        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">sub3</AttributeValue>
          <ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" />
        </ResourceMatch>
      </Resource>

      <Resource>
        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">moderation</AttributeValue>
          <ResourceAttributeDesignator AttributeId="policy_purpose" DataType="http://www.w3.org/2001/XMLSchema#string"/>
        </ResourceMatch>
      </Resource>

    </Resources>

  </Target>

  <Rule Effect="Permit" RuleId="PermitIfSubject.BranchMatches">


    <!--
      Head can only view marks of subjects of his branch.
    -->


    <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
        <SubjectAttributeDesignator AttributeId="db_acad_users_user_branch" DataType="http://www.w3.org/2001/XMLSchema#string"/>
      </Apply>
      <AttributeSelector RequestContextPath="//context:ResourceContent/db:subjects/db:subject/db:branch/text()" DataType="http://www.w3.org/2001/XMLSchema#string"/>

    </Condition>

  </Rule>

  <Rule Effect="Deny" RuleId="DenyIfBranchDoesnNotMatch" />
</Policy>