-
Notifications
You must be signed in to change notification settings - Fork 17
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update schema to include a namespace
Signed-off-by: Jonathan Marcantonio <[email protected]>
- Loading branch information
1 parent
212f5b8
commit 2d1587a
Showing
1 changed file
with
13 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,30 +1,30 @@ | ||
schema: |- | ||
definition user {} | ||
definition rbac/user {} | ||
definition group { | ||
relation member: user | group#member | ||
definition rbac/group { | ||
relation member: rbac/user | rbac/group#member | ||
} | ||
definition role { | ||
relation view_the_thing: user:* | ||
definition rbac/role { | ||
relation view_the_thing: rbac/user:* | ||
} | ||
definition role_binding { | ||
relation subject : user | group#member | ||
relation granted: role | ||
definition rbac/role_binding { | ||
relation subject : rbac/user | rbac/group#member | ||
relation granted: rbac/role | ||
permission view_the_thing = subject & granted->view_the_thing | ||
} | ||
definition workspace { | ||
relation parent: workspace | ||
relation user_grant: role_binding | ||
definition rbac/workspace { | ||
relation parent: rbac/workspace | ||
relation user_grant: rbac/role_binding | ||
permission view_the_thing = user_grant->view_the_thing | ||
} | ||
definition thing { | ||
relation workspace: workspace | ||
definition rbac/thing { | ||
relation workspace: rbac/workspace | ||
permission view = workspace->view_the_thing | ||
} |