# (c) cavaliba.com - permissions


# ------------------------------------------------------
# Core Permissions
# ------------------------------------------------------

# info/version
- classname: _permission
  keyname: p_info
  is_builtin: true
  description: Builtin Get Version/Info permission
  displayname: p_info


# home

- classname: _permission
  keyname: p_home_access
  is_builtin: true
  description: "HOME app Access"
  displayname: "p_home_access"

- classname: _permission
  keyname: p_home_admin
  is_builtin: true
  description: "HOME dashboard admin"
  displayname: p_home_admin

# conf

- classname: _permission
  keyname: p_conf_view
  is_builtin: true
  description: "conf view permission"
  displayname: p_conf_view

- classname: _permission
  keyname: p_conf_admin
  is_builtin: true
  description: "conf admin permission"
  displayname: "p_conf_admin"

# log

- classname: _permission
  keyname: p_log_view
  is_builtin: true
  description: "LOG view permission"
  displayname: "p_log_view"

- classname: _permission
  keyname: p_log_admin
  is_builtin: true
  description: "LOG admin permission"
  displayname: p_log_admin


# admintools
- classname: _permission
  keyname: p_admintools
  is_builtin: true
  description: "HOME admin tools access"
  displayname: p_admintools


# -------------------------------------------------
# IAM Permissions
# -------------------------------------------------

- classname: _permission
  keyname: p_iam_access
  is_builtin: true
  description: "IAM access"
  displayname: p_iam_access

- classname: _permission
  keyname: p_iam_impersonate
  is_builtin: true
  description: "IAM can impersonate other account"
  displayname: p_iam_impersonate

- classname: _permission
  keyname: p_iam_export
  is_builtin: true
  description: "IAM export permission"
  displayname: p_iam_export

# --------------------------------------
# IAM -- user
# --------------------------------------

- classname: _permission
  keyname: p_user_pref
  is_builtin: true
  description: "USER.preferences permission"
  displayname: p_user_pref

- classname: _permission
  keyname: p_user_email_test
  is_builtin: true
  description: "USER.test_email permission"
  displayname: p_user_email_test

- classname: _permission
  keyname: p_user_sms_test
  is_builtin: true
  description: "USER.test_sms permission"
  displayname: p_user_sms_test

- classname: _permission
  keyname: p_user_debug
  is_builtin: true
  description: "USER.debug permission"
  displayname: p_user_debug

- classname: _permission
  keyname: p_user_admin
  is_builtin: true
  description: "USER admin permission"
  displayname: p_user_admin

- classname: _permission
  keyname: p_user_read
  is_builtin: true
  description: "USER read permission"
  displayname: p_user_read

- classname: _permission
  keyname: p_user_create
  is_builtin: true
  description: "USER create permission"
  displayname: p_user_create

- classname: _permission
  keyname: p_user_update
  is_builtin: true
  description: "USER update permission"
  displayname: p_user_update

- classname: _permission
  keyname: p_user_delete
  is_builtin: true
  description: "USER delete permission"
  displayname: p_user_delete


# --------------------------------------
# IAM -- group
# --------------------------------------
- classname: _permission
  keyname: p_group_admin
  is_builtin: true
  description: "GROUP admin permission"
  displayname: "p_group_admin"

- classname: _permission
  keyname: p_group_read
  is_builtin: true
  description: "GROUP read permission"
  displayname: "p_group_read"

- classname: _permission
  keyname: p_group_create
  is_builtin: true
  description: "GROUP create permission"
  displayname: "p_group_create"

- classname: _permission
  keyname: p_group_update
  is_builtin: true
  description: "GROUP update permission"
  displayname: "p_group_update"

- classname: _permission
  keyname: p_group_delete
  is_builtin: true
  description: "GROUP delete permission"
  displayname: "p_group_delete"


# --------------------------------------
# IAM -- role
# --------------------------------------
- classname: _permission
  keyname: p_role_admin
  is_builtin: true
  description: "IAM role admin permission"
  displayname: p_role_admin

- classname: _permission
  keyname: p_role_read
  is_builtin: true
  description: "IAM role read permission"
  displayname: p_role_read

- classname: _permission
  keyname: p_role_create
  is_builtin: true
  description: "IAM role create permission"
  displayname: p_role_create

- classname: _permission
  keyname: p_role_update
  is_builtin: true
  description: "IAM role update permission"
  displayname: p_role_update

- classname: _permission
  keyname: p_role_delete
  is_builtin: true
  description: "IAM role delete permission"
  displayname: p_role_delete


# --------------------------------------
# IAM -- permission
# --------------------------------------

- classname: _permission
  keyname: p_permission_admin
  is_builtin: true
  description: "IAM permission admin permission"
  displayname: p_permission_admin

- classname: _permission
  keyname: p_permission_read
  is_builtin: true
  description: "IAM permission read permission"
  displayname: p_permission_read

- classname: _permission
  keyname: p_permission_create
  is_builtin: true
  description: "IAM permission create permission"
  displayname: p_permission_create

- classname: _permission
  keyname: p_permission_update
  is_builtin: true
  description: "IAM permission update permission"
  displayname: p_permission_update

- classname: _permission
  keyname: p_permission_delete
  is_builtin: true
  description: "IAM permission delete permission"
  displayname: p_permission_delete


# ---------------------
# Data PERMISSIONS
# ---------------------

# data access

- classname: _permission
  keyname: p_data_access
  is_builtin: true
  description: "DATA dashboard access"
  displayname: "p_data_access"


# security

- classname: _permission
  keyname: p_data_security_view
  is_builtin: true
  description: "DATA Security VIEW permission"
  displayname: p_data_security_view

- classname: _permission
  keyname: p_data_security_edit
  is_builtin: true
  description: "DATA Security EDIT permission"
  displayname: p_data_security_edit


# --------------------------------------
# schema
# --------------------------------------

- classname: _permission
  keyname: p_schema_read
  is_builtin: true
  description: "SCHEMA read"
  displayname: "p_schema_read"

- classname: _permission
  keyname: p_schema_write
  is_builtin: true
  description: "SCHEMA create, update, delete"
  displayname: "p_schema_wrtite"


# --------------------------------------
# p_data_admin all data classes + not blockable
# --------------------------------------

- classname: _permission
  keyname: p_data_admin
  is_builtin: true
  description: "DATA all permissions non-blocking"
  displayname: "p_data_admin"


# --------------------------------------
# all data classes  ; blockable downward
# --------------------------------------

- classname: _permission
  keyname: p_data_read
  is_builtin: true
  description: "DATA read all"
  displayname: "p_data_read"

- classname: _permission
  keyname: p_data_create
  is_builtin: true
  description: "DATA create all"
  displayname: "p_data_create"

- classname: _permission
  keyname: p_data_update
  is_builtin: true
  description: "DATA update all"
  displayname: "p_data_update"

- classname: _permission
  keyname: p_data_delete
  is_builtin: true
  description: "DATA delete all"
  displayname: "p_data_delete"

- classname: _permission
  keyname: p_data_import
  is_builtin: true
  description: "DATA UI import Tool"
  displayname: "p_data_import"

- classname: _permission
  keyname: p_data_export
  is_builtin: true
  description: "DATA UI export Tool (export)"
  displayname: p_data_export

- classname: _permission
  keyname: p_data_export_viewer
  is_builtin: true
  description: "DATA UI export Tool (viewer)"
  displayname: p_data_export

# -------------------------
# permission: _enumerate
# -------------------------

- classname: _permission
  keyname: p_enumerate_admin
  is_builtin: true
  description: "enumerate admin permission"
  displayname: "p_enumerate_admin"

- classname: _permission
  keyname: p_enumerate_create
  is_builtin: true
  description: "enumerate create permission"
  displayname: p_enumerate_create

- classname: _permission
  keyname: p_enumerate_read
  is_builtin: true
  description: "enumerate read permission"
  displayname: p_enumerate_read

- classname: _permission
  keyname: p_enumerate_update
  is_builtin: true
  description: "enumerate update permission"
  displayname: p_enumerate_update

- classname: _permission
  keyname: p_enumerate_delete
  is_builtin: true
  description: "enumerate delete permission"
  displayname: p_enumerate_delete


# -------------------------
# permission: _pipeline
# -------------------------

- classname: _permission
  keyname: p_pipeline_admin
  is_builtin: true
  description: "pipeline admin permission"
  displayname: "p_pipeline_admin"

- classname: _permission
  keyname: p_pipeline_create
  is_builtin: true
  description: "pipeline create permission"
  displayname: p_pipeline_create

- classname: _permission
  keyname: p_pipeline_read
  is_builtin: true
  description: "pipeline read permission"
  displayname: p_pipeline_read

- classname: _permission
  keyname: p_pipeline_update
  is_builtin: true
  description: "pipeline update permission"
  displayname: p_pipeline_update


- classname: _permission
  keyname: p_pipeline_delete
  is_builtin: true
  description: "pipeline delete permission"
  displayname: p_pipeline_delete

# v3.33
- classname: _permission
  keyname: p_pipeline_run
  is_builtin: true
  description: "pipeline run permission, eg for bulk transform pipelines"
  displayname: p_pipeline_run


# -------------------------
# permission: _dataview
# -------------------------

- classname: _permission
  keyname: p_dataview_admin
  is_builtin: true
  description: "dataview admin permission"
  displayname: "p_dataview_admin"

- classname: _permission
  keyname: p_dataview_create
  is_builtin: true
  description: "dataview create permission"
  displayname: p_dataview_create

- classname: _permission
  keyname: p_dataview_read
  is_builtin: true
  description: "dataview read permission"
  displayname: p_dataview_read

- classname: _permission
  keyname: p_dataview_update
  is_builtin: true
  description: "dataview update permission"
  displayname: p_dataview_update

- classname: _permission
  keyname: p_dataview_delete
  is_builtin: true
  description: "dataview delete permission"
  displayname: p_dataview_delete


# -------------------------
# permission: _apikey
# -------------------------

- classname: _permission
  keyname: p_apikey_admin
  is_builtin: true
  description: "APIKEY admin permission"
  displayname: "p_apikey_admin"

- classname: _permission
  keyname: p_apikey_create
  is_builtin: true
  description: "APIKEY create permission"
  displayname: p_apikey_create

- classname: _permission
  keyname: p_apikey_read
  is_builtin: true
  description: "APIKEY read permission"
  displayname: p_apikey_read

- classname: _permission
  keyname: p_apikey_update
  is_builtin: true
  description: "APIKEY update permission"
  displayname: p_apikey_update

- classname: _permission
  keyname: p_apikey_delete
  is_builtin: true
  description: "APIKEY delete permission"
  displayname: p_apikey_delete

# -------------------------
# permission: data tasks
# v3.33
# -------------------------

- classname: _permission
  keyname: p_task_view
  is_builtin: true
  displayname: "p_task_view"
  description: "View Async Tasks"

- classname: _permission
  keyname: p_task_manage
  is_builtin: true
  displayname: "p_task_manage"
  description: "Manage Async Tasks"

- classname: _permission
  keyname: p_task_all
  is_builtin: true
  displayname: "p_task_all"
  description: "All tasks (default = self tasks)"

# -------------------------
# permission: keyname rename
# v4.2.0
# gates POST /api/keyname/ (see app_data/api/keyname.py)
# (CLI action is admin-only by default, not gated by this permission)
# -------------------------

- classname: _permission
  keyname: p_keyname_rename
  is_builtin: true
  displayname: "p_keyname_rename"
  description: "Rename an instance keyname"

# -------------------------
# permission: load
# v4.4.0
# gates POST /api/load/ (see app_data/api/load.py) ; per-object create/update
# permission is still checked on top of this, same as p_data_import
# -------------------------

- classname: _permission
  keyname: p_api_load
  is_builtin: true
  displayname: "p_api_load"
  description: "Call the /api/load/ endpoint (synchronous small-batch JSON write)"

# -------------------------
# permission: rawfile
# v4.4.0
# gates POST /api/rawfile/ (see app_data/api/rawfile.py) ; per-object create/update
# permission is still checked on top of this, same as p_data_import for the UI import tool
# -------------------------

- classname: _permission
  keyname: p_api_rawfile
  is_builtin: true
  displayname: "p_api_rawfile"
  description: "Call the /api/rawfile/ endpoint (bulk raw file import: json/yaml/csv)"

# -------------------------
# permission: conf
# v4.5.0
# gates /api/conf/ (see app_data/api/conf.py) ; GET also requires p_conf_view
# or p_conf_admin, POST also requires p_conf_admin
# -------------------------

- classname: _permission
  keyname: p_api_conf
  is_builtin: true
  displayname: "p_api_conf"
  description: "Call the /api/conf/ endpoint (read/write Cavaliba configuration)"
