# (c) cavaliba.com


# -------------------------------------------------------------
# schema: role
# v4.0
# -------------------------------------------------------------

- classname: _schema
  keyname: role
  _action: init
  is_enabled: yes
  displayname: Roles
  _options:
      icon: fa-user-secret
      p_admin: p_role_admin
      p_create: p_role_create
      p_read: p_role_read
      p_update: p_role_update
      p_delete: p_role_delete
      field_hide_from_detail: 
      - users
      - groups
      - permissions

  description:
      displayname: Description
      order: 100
      dataformat: string

  is_builtin:
    displayname: Builtin
    dataformat: boolean

  users:
      displayname: Users
      dataformat: schema
      dataformat_ext: user
      cardinal_max: 0

  groups:
      displayname: Groups
      dataformat: schema
      dataformat_ext: group
      cardinal_max: 0

  permissions:
      displayname: Permissions
      dataformat: permission
      cardinal_max: 0
  


# -------------------------------------------------------------
# builtin roles
# -------------------------------------------------------------

# role_admin - all permissions by default (code)

- classname: role
  keyname: role_admin
  displayname: Built-in Global Admin role
  is_builtin: true
  is_enabled: True
  _action: init
  users:
    - admin
    

# role default

- classname: role
  keyname: role_default
  is_builtin: True
  is_enabled: True
  _action: init
  displayname: Built-in Default role for new users/anonymous/visitors
  permissions:
    - p_home_access
    - p_data_access
    - p_sirene_access
    - p_sirene_history
    - p_sirene_detail

    
# --------------------
# IAM Roles
# --------------------


- classname: role
  keyname: role_iam_admin
  is_builtin: True
  is_enabled: True
  _action: init
  displayname: Built-in IAM ADMIN Role
  permissions: 
    - p_iam_access
    - p_iam_export
    - p_user_pref
    - p_user_email_test
    - p_user_sms_test
    - p_user_debug
    - p_user_read
    - p_user_create
    - p_user_update
    - p_user_delete
    - p_group_read
    - p_group_create
    - p_group_update
    - p_group_delete
    - p_role_read
    - p_role_create
    - p_role_update
    - p_role_delete
    - p_permission_read
    - p_permission_create
    - p_permission_update
    - p_permission_delete


  

# API
- classname: role
  _action: init
  keyname: role_api_read
  displayname: Built-in DATA API Read role
  is_builtin: true
  is_enabled: True
  permissions:
      - p_info
      - p_data_read
      - p_data_app_read
      - p_data_site_read
      - p_data_sitegroup_read
      - p_data_sirene_template_read
      - p_data_sirene_public_read
      - p_enumerate_read
      - p_dataview_read
      - p_pipeline_read
      - p_group_read
      - p_role_read
      - p_user_read
      - p_status_read
      - p_ipam_read
      - p_schema_read
      - p_conf_view
      - p_log_view
      #- p_apikey_read

- classname: role
  _action: init
  keyname: role_api_admin
  displayname: Built-in DATA API Admin Role
  is_builtin: true
  is_enabled: True
  permissions:
      - p_info
      - p_data_admin
      - p_user_create
      - p_user_update
      - p_user_delete
      - p_user_read
      - p_group_create
      - p_group_update
      - p_group_delete
      - p_group_read
      - p_ipam_admin
      - p_log_admin
      - p_status_admin


  
# --------------------
# Data ROLES
# --------------------

- classname: role
  keyname: role_schema_admin
  displayname: Built-in SCHEMA admin role
  is_builtin: true
  is_enabled: True
  _action: create
  permissions:
      - p_data_access
      - p_schema_write

- classname: role
  keyname: role_data_admin
  displayname: Built-in DATA admin role
  is_builtin: true
  is_enabled: True
  _action: create
  permissions:
      - p_schema_read
      - p_data_access
      - p_data_admin
      - p_data_security_view

- classname: role
  keyname: role_data_read
  displayname: Built-in DATA read role
  is_builtin: true
  is_enabled: True
  _action: init
  permissions:
      - p_data_access
      - p_data_read

- classname: role
  keyname: role_data_create
  displayname: Built-in DATA create role
  is_builtin: true
  is_enabled: True
  _action: init
  permissions:
      - p_data_access
      - p_data_read
      - p_data_create

- classname: role
  keyname: role_data_update
  displayname: Built-in DATA update role
  is_builtin: true
  is_enabled: True
  _action: init
  permissions:
      - p_data_access
      - p_data_read
      - p_data_update

- classname: role
  keyname: role_data_delete
  displayname: Built-in DATA delete role
  is_builtin: true
  is_enabled: True
  _action: init
  permissions:
      - p_data_access
      - p_data_read
      - p_data_delete
