<?xml version="1.0" encoding="UTF-8"?>
 <Policy  PolicyId="student"
          xmlns="urn:oasis:names:tc:xacml:1.0:policy"
          xmlns:context="urn:oasis:names:tc:xacml:1.0:context"
          xmlns:db="db_acad"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">

    <Description>A student can view their own marks or marks of another student if he is permitted to do so.</Description>
   
    <PolicyDefaults>
      <XPathVersion>http://www.w3.org/TR/1999/Rec-xpath-19991116</XPathVersion>
    </PolicyDefaults>
   <!--
    #Policy is meant for the role student
    #Policy Applicable only when subject wants to view Information
    #Policy is applicable when resources to be accessed are sub1, sub2, sub3.
    -->
    <Target>
      
      <Subjects>
        <Subject>
          <SubjectMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">student</AttributeValue>
            <SubjectAttributeDesignator AttributeId="db_acad_users_user_role" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true" />
          </SubjectMatch>
        </Subject>
      </Subjects>

      <Actions>
        <Action>
          <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">view</AttributeValue>
            <ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" />
          </ActionMatch>
        </Action>
      </Actions>

      <Resources>

        <Resource>
          <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">sub1</AttributeValue>
            <ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
          </ResourceMatch>
        </Resource>

        <Resource>
          <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">sub2</AttributeValue>
            <ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" />
          </ResourceMatch>
        </Resource>

        <Resource>
          <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">sub3</AttributeValue>
            <ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" />
          </ResourceMatch>
        </Resource>

      </Resources>
      
    </Target>

   <!--This rule describes the conditions and target values when student wants to view his own marks-->
   <Rule Effect="Permit" RuleId="PermitIfViewSelf">


     <!--A user can only see
      his own information. So the
      username of the target whose
      info must be edited must match
      with the username of the user
      who wants to edit.
      -->

     <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">

       <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
         <SubjectAttributeDesignator AttributeId="db_acad_users_user_username" DataType="http://www.w3.org/2001/XMLSchema#string"/>
       </Apply>

       <AttributeSelector RequestContextPath="//context:ResourceContent/db:user[@type='target']/db:username/text()" DataType="http://www.w3.org/2001/XMLSchema#string"/>

     </Condition>
   </Rule>

   <!--
   #Rule : Student wants to view another student's marks
   #Purpose : analysis
   #Condition: Student must be permitted to view the marks by the target student
   -->
   <Rule Effect="Permit" RuleId="PermitIfPermitOther">

      <Target>

        <Resources>

             <Resource>
              <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">analysis</AttributeValue>
                <ResourceAttributeDesignator AttributeId="policy_purpose" DataType="http://www.w3.org/2001/XMLSchema#string"/>
              </ResourceMatch>
            </Resource>

        </Resources>

       
      </Target>

      <!--A user can only see
      his own information. So the
      username of the target whose
      info must be edited must match
      with the username of the user
      who wants to edit.
      -->

      <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">

        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
          <SubjectAttributeDesignator AttributeId="db_acad_users_user_username" DataType="http://www.w3.org/2001/XMLSchema#string"/>
        </Apply>

        <AttributeSelector RequestContextPath="//context:ResourceContent/db:user/db:permit/text()" DataType="http://www.w3.org/2001/XMLSchema#string"/>

      </Condition>
    </Rule>

   <!--
   The policy should return a deny in all other cases
   -->
   <Rule Effect="Deny" RuleId="DenyOtherwise" />
  </Policy>