query-orchestration/cmd/cognito_test/permit.setup/permit_policies.yaml

---
# Permit.io Roles and Policies Configuration
# This file defines the RBAC structure for the Query Orchestration API
# Use with Permit.io SDK to programmatically create roles and policies

# Resources to be created in Permit.io
resources:
  - name: admin
    description: Administrative functions (user management)
    actions:
      - get
      - post
      - patch
      - delete
      - head

  - name: client
    description: Single client operations
    actions:
      - get
      - post
      - patch
      - delete

  - name: clients
    description: Clients administration
    actions:
      - get
      - post
      - patch
      - delete

  - name: query
    description: Query definitions and execution
    actions:
      - get
      - post
      - patch

  - name: document
    description: Document upload and management
    actions:
      - get
      - post
      - delete

  - name: export
    description: Export operations
    actions:
      - get
      - post

  - name: field-extractions
    description: Field extraction data for documents
    actions:
      - get
      - post

  - name: folders
    description: Folder management for document organization
    actions:
      - get
      - post
      - patch

  - name: home
    description: Home page access
    actions:
      - get

# Roles to be created in Permit.io
roles:
  - name: super_admin
    description: Full system access for platform administrators
    permissions:
      admin:
        - get
        - post
        - patch
        - delete
        - head
      client:
        - get
        - post
        - patch
        - delete
      clients:
        - get
        - post
        - patch
        - delete
      query:
        - get
        - post
        - patch
      document:
        - get
        - post
        - delete
      export:
        - get
        - post
      field-extractions:
        - get
        - post
      folders:
        - get
        - post
        - patch
      home:
        - get

  - name: user_admin
    description: User management - primarily for creating new client users
    permissions:
      admin:
        - get
        - post
        - patch
        - delete
        - head
      field-extractions:
        - get
        - post
      folders:
        - get
        - post
      home:
        - get

  - name: auditor
    description: Full read-only access across the entire system for auditing and compliance
    permissions:
      admin:
        - get
        - head
      client:
        - get
      clients:
        - get
      query:
        - get
      document:
        - get
      export:
        - get
      field-extractions:
        - get
      folders:
        - get
      home:
        - get

  - name: client_user
    description: Client-specific access for external users (requires tenant filtering)
    permissions:
      client:
        - get
        - post
        - patch
        - delete
      document:
        - get
      export:
        - get
        - post
      field-extractions:
        - get
        - post
      folders:
        - get
        - post
        - patch
      home:
        - get
    notes: |
      This role requires tenant-level filtering by client_id.
      Currently, client_user will have access to all clients (no tenant isolation).
      Future implementation will require application-level filtering based on client_id attribute.

# Documentation only from here down.
#
# All of the sections that follow are for documentation only and can be removed.
# They are not used by the permit setup tool.

# Policy mappings - maps HTTP endpoints to resource:action combinations
# This section documents how the dynamic mapping works
policy_mappings:
  admin_endpoints:
    - path: /admin/users
      methods:
        GET: admin:get
        POST: admin:post
    - path: /admin/users/{email}
      methods:
        GET: admin:get
        HEAD: admin:head
        PATCH: admin:patch
        DELETE: admin:delete
    - path: /admin/users/{email}/disable
      methods:
        POST: admin:post
    - path: /admin/users/{email}/enable
      methods:
        POST: admin:post

  client_endpoints:
    - path: /client
      methods:
        POST: client:post
    - path: /client/{id}
      methods:
        GET: client:get
        PATCH: client:patch
    - path: /client/{id}/status
      methods:
        GET: client:get
    - path: /client/{id}/collector
      methods:
        GET: client:get
        PATCH: client:patch
    - path: /client/{id}/document
      methods:
        GET: client:get
        POST: client:post
    - path: /client/{id}/document/batch
      methods:
        GET: client:get
        POST: client:post
    - path: /client/{id}/document/batch/{batch_id}
      methods:
        GET: client:get
        DELETE: client:delete
    - path: /client/{id}/export
      methods:
        POST: client:post

  query_endpoints:
    - path: /query
      methods:
        GET: query:get
        POST: query:post
    - path: /query/{id}
      methods:
        GET: query:get
        PATCH: query:patch
    - path: /query/{id}/test
      methods:
        POST: query:post

  document_endpoints:
    - path: /document/{id}
      methods:
        GET: document:get

  export_endpoints:
    - path: /export/{id}
      methods:
        GET: export:get

  field_extraction_endpoints:
    - path: /field-extractions
      methods:
        GET: field-extractions:get
        POST: field-extractions:post
    - path: /field-extractions/version
      methods:
        GET: field-extractions:get
    - path: /field-extractions/history
      methods:
        GET: field-extractions:get

  auth_endpoints:
    - path: /home
      methods:
        GET: home:get
    - path: /login
      public: true
    - path: /login-callback
      public: true
    - path: /logout
      authenticated: true
      no_permission_check: true
    - path: /swagger/*
      public: true
    - path: /metrics
      public: true
    - path: /health
      public: true

# Dynamic mapping rules
# These define how the middleware extracts resource and action from requests
dynamic_mapping:
  resource_extraction:
    logic: First path segment after leading slash
    examples:
      - url: /client/AAA
        resource: client
      - url: /query/019580df-ef65-7676-8de9-94435a93337a
        resource: query
      - url: /document/019580df-b3f8-7348-9ab1-1e55b3f18ed7
        resource: document
      - url: /admin/users
        resource: admin
      - url: /field-extractions
        resource: field-extractions

  action_extraction:
    logic: HTTP method converted to lowercase
    examples:
      - method: GET
        action: get
      - method: POST
        action: post
      - method: PATCH
        action: patch
      - method: DELETE
        action: delete
      - method: HEAD
        action: head

  # Implementation notes
  notes:
    - Admin endpoints restricted to super_admin and admin roles only
    - Auditor has read-only access across all resources
    - Client_user currently has access to all clients (no tenant isolation)
    - Tenant isolation will require application changes (not initial requirement)