schema-complete.tql

define

user sub entity,
    owns email,
    owns password-hash,
    owns created-timestamp,
    owns active;

admin sub user;

user-group sub entity,
    owns name,
    owns created-timestamp;

resource sub entity,
    abstract,
    owns id,
    owns created-timestamp,
    owns modified-timestamp;

file sub resource,
    owns path as id;

directory sub resource,
    owns path as id;

access sub entity,
    owns name;

id sub attribute, abstract, value string;
email sub id;
name sub id;
path sub id;
password-hash sub attribute, value string;
event-timestamp sub attribute, abstract, value datetime;
created-timestamp sub event-timestamp;
modified-timestamp sub event-timestamp;
active sub attribute, value boolean;

define

ownership sub relation,
    abstract,
    relates owned,
    relates owner;

group-ownership sub ownership,
    relates group as owned,
    relates group-owner as owner;

resource-ownership sub ownership,
    relates resource as owned,
    relates resource-owner as owner;

membership sub relation,
    abstract,
    relates parent,
    relates member;

group-membership sub membership,
    relates group as parent,
    relates group-member as member;

directory-membership sub membership,
    relates directory as parent,
    relates directory-member as member;

permission sub relation,
    relates subject,
    relates object,
    relates access;

login-event sub relation,
    relates subject,
    owns login-timestamp,
    owns success;

login-timestamp sub event-timestamp;
success sub attribute, value boolean;

define

user plays resource-ownership:resource-owner,
    plays group-membership:group-member,
    plays permission:subject,
    plays login-event:subject;

admin plays group-ownership:group-owner;

user-group plays group-ownership:group,
    plays resource-ownership:resource-owner,
    plays group-membership:group,
    plays permission:subject,
    plays permission:object;

resource plays resource-ownership:resource,
    plays permission:object;

file plays directory-membership:directory-member;

directory plays directory-membership:directory,
    plays directory-membership:directory-member;

access plays permission:access;

define

repository sub resource,
    owns name as id,
    plays commit:repository;

commit sub relation,
    relates repository,
    relates author,
    owns hash,
    owns created-timestamp;

user plays commit:author;

hash sub id;

define

last-modified sub attribute, value datetime;
resource owns last-modified;

define

rule resource-last-modified:
    when {
        $resource isa resource, has modified-timestamp $last-modified;
        not {
            $resource has modified-timestamp $other-modified;
            $other-modified > $last-modified;
        };
        ?timestamp = $last-modified;
    } then {
        $resource has last-modified ?timestamp;
    };

define

rule implicit-last-modified:
    when {
        $resource isa resource, has created-timestamp $created;
        not { $resource has modified-timestamp $modified; };
        ?timestamp = $created;
    } then {
        $resource has last-modified ?timestamp;
    };

define

rule repository-modified-timestamps:
    when {
        $repository isa repository;
        (repository: $repository) isa commit, has created-timestamp $commit-created;
        ?timestamp = $commit-created;
    } then {
        $repository has modified-timestamp ?timestamp;
    };

define

indirect-directory-membership sub directory-membership;

rule transitive-directory-memberships:
    when {
        (directory: $directory-1, directory-member: $directory-2) isa directory-membership;
        (directory: $directory-2, directory-member: $object) isa directory-membership;
    } then {
        (directory: $directory-1, directory-member: $object) isa indirect-directory-membership;
    };

define

last-login sub attribute, value datetime;
user owns last-login;

rule automatic-last-login:
    when {
        $user isa user;
        (subject: $user) isa login-event,
            has success true,
            has login-timestamp $last-login;
        not {
            (subject: $user) isa login-event,
                has success true,
                has login-timestamp $other-login;
            $other-login > $last-login;
        };
        ?timestamp = $last-login;
    } then {
        $user has last-login ?timestamp;
    };

define

group-permission sub permission;

rule transitive-group-permissions:
    when {
        (group: $group, group-member: $user) isa group-membership;
        (subject: $group, object: $object, access: $access) isa permission;
    } then {
        (subject: $user, object: $object, access: $access) isa group-permission;
    };

define

owner-permission sub permission;

rule full-owner-permissions:
    when {
        (owned: $object, owner: $owner) isa ownership;
        $access isa access;
    } then {
        (subject: $owner, object: $object, access: $access) isa owner-permission;
    };

define

admin-permission sub permission;

rule full-admin-permissions:
    when {
        $admin isa admin;
        $type plays permission:object;
        $object isa $type;
        $access isa access;
    } then {
        (subject: $admin, object: $object, access: $access) isa admin-permission;
    };

define

implied-permission sub permission;

rule implied-read-permission:
    when {
        $read isa access, has name "read";
        $write isa access, has name "write";
        (subject: $subject, object: $object, access: $write) isa permission;
    } then {
        (subject: $subject, object: $object, access: $read) isa implied-permission;
    };