Jay Brown
09c61ea9b4
support delete for client, document and folder * support delete for client, document and folder * remove batch cancel conflict not used Approved-by: Jacob Mathison
400 lines
8.8 KiB
YAML
400 lines
8.8 KiB
YAML
---
|
|
# Permit.io Roles and Policies Configuration
|
|
# This file defines the RBAC structure for the Query Orchestration API
|
|
# Use with Permit.io SDK to programmatically create roles and policies
|
|
|
|
# Resources to be created in Permit.io
|
|
resources:
|
|
- name: admin
|
|
description: Administrative functions (user management)
|
|
actions:
|
|
- get
|
|
- post
|
|
- patch
|
|
- delete
|
|
- head
|
|
|
|
- name: client
|
|
description: Single client operations
|
|
actions:
|
|
- get
|
|
- post
|
|
- patch
|
|
- delete
|
|
|
|
- name: clients
|
|
description: Clients administration
|
|
actions:
|
|
- get
|
|
- post
|
|
- patch
|
|
- delete
|
|
|
|
- name: document
|
|
description: Document upload and management
|
|
actions:
|
|
- get
|
|
- post
|
|
- delete
|
|
|
|
- name: export
|
|
description: Export operations
|
|
actions:
|
|
- get
|
|
- post
|
|
|
|
- name: documents
|
|
description: Label operations on documents
|
|
actions:
|
|
- get
|
|
- post
|
|
|
|
- name: field-extractions
|
|
description: Field extraction data for documents
|
|
actions:
|
|
- get
|
|
- post
|
|
|
|
- name: folders
|
|
description: Folder management for document organization
|
|
actions:
|
|
- get
|
|
- post
|
|
- patch
|
|
- delete
|
|
|
|
- name: labels
|
|
description: Label-based document lookup
|
|
actions:
|
|
- get
|
|
|
|
# Roles to be created in Permit.io
|
|
roles:
|
|
- name: super_admin
|
|
description: Full system access for platform administrators
|
|
permissions:
|
|
admin:
|
|
- get
|
|
- post
|
|
- patch
|
|
- delete
|
|
- head
|
|
client:
|
|
- get
|
|
- post
|
|
- patch
|
|
- delete
|
|
clients:
|
|
- get
|
|
- post
|
|
- patch
|
|
- delete
|
|
document:
|
|
- get
|
|
- post
|
|
- delete
|
|
export:
|
|
- get
|
|
- post
|
|
documents:
|
|
- get
|
|
- post
|
|
field-extractions:
|
|
- get
|
|
- post
|
|
folders:
|
|
- get
|
|
- post
|
|
- patch
|
|
- delete
|
|
labels:
|
|
- get
|
|
|
|
- name: user_admin
|
|
description: User management - primarily for creating new client users
|
|
permissions:
|
|
admin:
|
|
- get
|
|
- post
|
|
- patch
|
|
- delete
|
|
- head
|
|
documents:
|
|
- get
|
|
- post
|
|
field-extractions:
|
|
- get
|
|
- post
|
|
folders:
|
|
- get
|
|
- post
|
|
|
|
- name: auditor
|
|
description: Full read-only access across the entire system for auditing and compliance
|
|
permissions:
|
|
admin:
|
|
- get
|
|
- head
|
|
client:
|
|
- get
|
|
clients:
|
|
- get
|
|
document:
|
|
- get
|
|
export:
|
|
- get
|
|
documents:
|
|
- get
|
|
field-extractions:
|
|
- get
|
|
folders:
|
|
- get
|
|
labels:
|
|
- get
|
|
|
|
- name: client_user
|
|
description: Client-specific access for external users (requires tenant filtering)
|
|
permissions:
|
|
client:
|
|
- get
|
|
- post
|
|
- patch
|
|
clients:
|
|
- get
|
|
document:
|
|
- get
|
|
export:
|
|
- get
|
|
- post
|
|
documents:
|
|
- get
|
|
- post
|
|
field-extractions:
|
|
- get
|
|
- post
|
|
folders:
|
|
- get
|
|
- post
|
|
- patch
|
|
labels:
|
|
- get
|
|
notes: |
|
|
This role requires tenant-level filtering by client_id.
|
|
Currently, client_user will have access to all clients (no tenant isolation).
|
|
Future implementation will require application-level filtering based on client_id attribute.
|
|
|
|
# Documentation only from here down.
|
|
#
|
|
# All of the sections that follow are for documentation only and can be removed.
|
|
# They are not used by the permit setup tool.
|
|
|
|
# Policy mappings - maps HTTP endpoints to resource:action combinations
|
|
# This section documents how the dynamic mapping works
|
|
policy_mappings:
|
|
admin_endpoints:
|
|
- path: /admin/users
|
|
methods:
|
|
GET: admin:get
|
|
POST: admin:post
|
|
- path: /admin/users/{email}
|
|
methods:
|
|
GET: admin:get
|
|
HEAD: admin:head
|
|
PATCH: admin:patch
|
|
DELETE: admin:delete
|
|
- path: /admin/users/{email}/disable
|
|
methods:
|
|
POST: admin:post
|
|
- path: /admin/users/{email}/enable
|
|
methods:
|
|
POST: admin:post
|
|
|
|
client_endpoints:
|
|
- path: /client
|
|
methods:
|
|
POST: client:post
|
|
- path: /client/{id}
|
|
methods:
|
|
GET: client:get
|
|
PATCH: client:patch
|
|
DELETE: client:delete
|
|
- path: /client/{id}/status
|
|
methods:
|
|
GET: client:get
|
|
- path: /client/{id}/collector
|
|
methods:
|
|
GET: client:get
|
|
PATCH: client:patch
|
|
- path: /client/{id}/document
|
|
methods:
|
|
GET: client:get
|
|
POST: client:post
|
|
- path: /client/{id}/document/batch
|
|
methods:
|
|
GET: client:get
|
|
POST: client:post
|
|
- path: /client/{id}/document/batch/{batch_id}
|
|
methods:
|
|
GET: client:get
|
|
DELETE: client:delete
|
|
- path: /client/{id}/export
|
|
methods:
|
|
POST: client:post
|
|
- path: /client/{id}/folders
|
|
methods:
|
|
GET: client:get
|
|
|
|
clients_endpoints:
|
|
- path: /clients
|
|
methods:
|
|
GET: clients:get
|
|
|
|
document_endpoints:
|
|
- path: /document/{id}
|
|
methods:
|
|
GET: document:get
|
|
DELETE: document:delete
|
|
|
|
export_endpoints:
|
|
- path: /export/{id}
|
|
methods:
|
|
GET: export:get
|
|
|
|
field_extraction_endpoints:
|
|
- path: /field-extractions
|
|
methods:
|
|
GET: field-extractions:get
|
|
POST: field-extractions:post
|
|
- path: /field-extractions/version
|
|
methods:
|
|
GET: field-extractions:get
|
|
- path: /field-extractions/history
|
|
methods:
|
|
GET: field-extractions:get
|
|
|
|
labels_endpoints:
|
|
- path: /documents/{documentId}/labels
|
|
methods:
|
|
POST: documents:post
|
|
GET: documents:get
|
|
- path: /labels/{labelName}/documents
|
|
methods:
|
|
GET: labels:get
|
|
|
|
folders_endpoints:
|
|
- path: /folders
|
|
methods:
|
|
POST: folders:post
|
|
- path: /folders/{folderId}
|
|
methods:
|
|
PATCH: folders:patch
|
|
DELETE: folders:delete
|
|
- path: /folders/{folderId}/documents
|
|
methods:
|
|
GET: folders:get
|
|
- path: /folders/{folderId}/metrics
|
|
methods:
|
|
GET: folders:get
|
|
|
|
eula_endpoints:
|
|
- path: /eula
|
|
public: true
|
|
- path: /eula/status
|
|
authenticated: true
|
|
no_permission_check: true
|
|
- path: /eula/agree
|
|
authenticated: true
|
|
no_permission_check: true
|
|
- path: /admin/eula
|
|
methods:
|
|
GET: admin:get
|
|
POST: admin:post
|
|
- path: /admin/eula/{version_id}
|
|
methods:
|
|
GET: admin:get
|
|
PATCH: admin:patch
|
|
- path: /admin/eula/{version_id}/activate
|
|
methods:
|
|
POST: admin:post
|
|
- path: /admin/eula/agreements
|
|
methods:
|
|
GET: admin:get
|
|
- path: /admin/eula/compliance
|
|
methods:
|
|
GET: admin:get
|
|
|
|
identity_endpoints:
|
|
- path: /identity
|
|
authenticated: true
|
|
no_permission_check: true
|
|
|
|
auth_endpoints:
|
|
- path: /home
|
|
public: true
|
|
- path: /login
|
|
public: true
|
|
- path: /login-callback
|
|
public: true
|
|
- path: /logout
|
|
authenticated: true
|
|
no_permission_check: true
|
|
- path: /eula
|
|
public: true
|
|
- path: /eula/status
|
|
authenticated: true
|
|
no_permission_check: true
|
|
- path: /eula/agree
|
|
authenticated: true
|
|
no_permission_check: true
|
|
- path: /identity
|
|
authenticated: true
|
|
no_permission_check: true
|
|
- path: /swagger/*
|
|
public: true
|
|
- path: /metrics
|
|
public: true
|
|
- path: /health
|
|
public: true
|
|
|
|
# Dynamic mapping rules
|
|
# These define how the middleware extracts resource and action from requests
|
|
dynamic_mapping:
|
|
resource_extraction:
|
|
logic: First path segment after leading slash
|
|
examples:
|
|
- url: /client/AAA
|
|
resource: client
|
|
- url: /document/019580df-b3f8-7348-9ab1-1e55b3f18ed7
|
|
resource: document
|
|
- url: /admin/users
|
|
resource: admin
|
|
- url: /field-extractions
|
|
resource: field-extractions
|
|
- url: /labels/contract/documents
|
|
resource: labels
|
|
- url: /folders/019580df-1234-5678-abcd-1e55b3f18ed7/documents
|
|
resource: folders
|
|
|
|
action_extraction:
|
|
logic: HTTP method converted to lowercase
|
|
examples:
|
|
- method: GET
|
|
action: get
|
|
- method: POST
|
|
action: post
|
|
- method: PATCH
|
|
action: patch
|
|
- method: DELETE
|
|
action: delete
|
|
- method: HEAD
|
|
action: head
|
|
|
|
# Implementation notes
|
|
notes:
|
|
- Admin endpoints restricted to super_admin and user_admin roles only
|
|
- Auditor has read-only access across all resources
|
|
- Client_user currently has access to all clients (no tenant isolation)
|
|
- Tenant isolation will require application changes (not initial requirement)
|
|
- /identity, /eula/status, and /eula/agree are auth-only (bypass Permit.io authorization)
|
|
- /home and /eula are fully public paths (no auth or permit check)
|