﻿<?xml version="1.0" encoding="UTF-8"?>
<Policy  PolicyId="teacher"
         xmlns="urn:oasis:names:tc:xacml:1.0:policy"
         xmlns:context="urn:oasis:names:tc:xacml:1.0:context"
         xmlns:db="db_acad"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">

  <Description>
    A teacher can edit the marks of a
    student for marking purpose if they
    teach that particular subject.
  </Description>

  <PolicyDefaults>
    <XPathVersion>http://www.w3.org/TR/1999/Rec-xpath-19991116</XPathVersion>
  </PolicyDefaults>

  <!--
  #Policy is applicable to Role: Teacher
  #Action: edit
  #Resources: sub1, sub2, sub3
  #Purpose: marking
  -->
  <Target>

    <Subjects>
      <Subject>
        <SubjectMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">teacher</AttributeValue>
          <SubjectAttributeDesignator AttributeId="db_acad_users_user_role" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true" />
        </SubjectMatch>
      </Subject>
    </Subjects>

    <Actions>
      <Action>
        <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">edit</AttributeValue>
          <ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string" />
        </ActionMatch>
      </Action>
    </Actions>

    <Resources>

      <Resource>
        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">sub1</AttributeValue>
          <ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false" />
        </ResourceMatch>
      </Resource>

      <Resource>
        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">sub2</AttributeValue>
          <ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" />
        </ResourceMatch>
      </Resource>

      <Resource>
        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">sub3</AttributeValue>
          <ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string" />
        </ResourceMatch>
      </Resource>

      <Resource>
        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">marking</AttributeValue>
          <ResourceAttributeDesignator AttributeId="policy_purpose" DataType="http://www.w3.org/2001/XMLSchema#string"/>
        </ResourceMatch>
      </Resource>

    </Resources>

  </Target>

  <!--
  #Teacher can edit the marks of only the subject they teach.
  -->
  <Rule Effect="Permit" RuleId="PermitIfTeacherTeachesSubject">


    <!--
      Teacher can only edit the marks in a subject
      if they teach a particular subject.
    -->


    <Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
      <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
        <ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
      </Apply>
      <AttributeSelector RequestContextPath="//context:ResourceContent/db:user[@type='subject']/db:teach/text()" DataType="http://www.w3.org/2001/XMLSchema#string"/>
      
    </Condition>

  </Rule>
<!--
  Return Deny in all other cases
  -->
  <Rule Effect="Permit" RuleId="PermitIfTeacherTeachesSubject" />
  </Policy>
