permissions.yml

permissions:
  # Everyone can read activities.
  - operation: Read Activity

  # Only authenticated users can create activities.
  - operation: Create Activity
    authenticated: true
    roles:
      - user
    fields:
      - description
      - lesson_id
      - name
      - study_id
      - user_id
  # Only owners can update/delete activities.
  - operation: Update Activity
    authenticated: true
    roles:
      - owner
    fields:
      - description
      - lesson_id
      - name
  - operation: Delete Activity
    authenticated: true
    roles:
      - owner



  # Only owners can connect/disconnect activity assets.
  - operation: Connect ActivityAsset 
    authenticated: true
    roles:
      - owner
  - operation: Disconnect ActivityAsset
    authenticated: true
    roles:
      - owner
  # Owners can read/update activity assets.
  - operation: Read ActivityAsset
    authenticated: true
    roles:
      - owner
  - operation: Update ActivityAsset
    authenticated: true
    roles:
      - owner
    fields:
      - number



  # Only authenticated users can connect/disconnect appled.
  - operation: Connect Appled 
    authenticated: true
    roles:
      - user
  - operation: Disconnect Appled
    authenticated: true
    roles:
      - owner
  # Owners can read the appled.
  - operation: Read Appled
    authenticated: true
    roles:
      - owner



  # Everyone can read the following fields for a asset.
  - operation: Read Asset
    fields:
      - created_at
      - id
      - key
      - name
      - size
      - subtype
      - type
      - user_id 
  # Admins and owners can read the whole asset.
  - operation: Read Asset
    authenticated: true
    roles:
      - admin
      - owner
  # Only authenticated users can create assets. 
  - operation: Create Asset
    authenticated: true
    roles:
      - user
    fields:
      - name
      - size
      - subtype
      - type
      - user_id



  # Everyone can read comments.
  - operation: Read Comment
    fields:
      - body
      - commentable_id
      - created_at
      - id
      - published_at
      - study_id
      - type
      - updated_at
      - user_id
  # Admins and owners can read the whole comment.
  - operation: Read Comment
    authenticated: true
    roles:
      - admin
      - owner
  # Only authenticated users can create comments.
  - operation: Create Comment
    authenticated: true
    roles:
      - user
    fields:
      - body
      - commentable_id
      - study_id
      - type
      - user_id
  # Only owners can update/delete comments. 
  - operation: Update Comment
    authenticated: true
    roles:
      - owner
    fields:
      - body
      - draft
      - published_at
  - operation: Delete Comment
    authenticated: true
    roles:
      - owner



  # Everyone can read courses.
  - operation: Read Course

  # Only authenticated users can create courses.
  - operation: Create Course
    authenticated: true
    roles:
      - user
    fields:
      - description
      - name
      - study_id
      - user_id
  # Only owners can update/delete courses.
  - operation: Update Course
    authenticated: true
    roles:
      - owner
    fields:
      - description
      - name
      - published_at
      - status
  - operation: Delete Course
    authenticated: true
    roles:
      - owner



  # Only owners can connect/disconnect course lessons.
  - operation: Connect CourseLesson 
    authenticated: true
    roles:
      - owner
  - operation: Disconnect CourseLesson
    authenticated: true
    roles:
      - owner
  # Owners can read/update course lessons.
  - operation: Read CourseLesson
    authenticated: true
    roles:
      - owner
  - operation: Update CourseLesson
    authenticated: true
    roles:
      - owner
    fields:
      - number



  # Only authenticated users can create emails.
  - operation: Create Email
    authenticated: true
    roles:
      - user
    fields:
      - type
      - user_id
      - value
  # Owners can read the whole email object.
  - operation: Read Email
    authenticated: true
    roles:
      - owner
  # Everyone can read the following fields for an email 
  # NOTE: the email must be public
  - operation: Read Email
    fields:
      - id
      - value
  # Only owners can update/delete emails.
  - operation: Update Email
    authenticated: true
    roles:
      - owner
    fields:
      - type
      - verified_at
  - operation: Delete Email
    authenticated: true
    roles:
      - owner



  # Only authenticated users can connect/disconnect enrolled.
  - operation: Connect Enrolled 
    authenticated: true
    roles:
      - user
  - operation: Disconnect Enrolled
    authenticated: true
    roles:
      - owner
  # Owners can read the enrolled.
  - operation: Read Enrolled
    authenticated: true
    roles:
      - owner
  - operation: Update Enrolled
    authenticated: true
    roles:
      - owner
    fields:
      - status



  # Only owners can create email verification tokens.
  - operation: Create EVT
    authenticated: true
    roles:
      - owner
    fields:
      - email_id
      - user_id
  # Everyone can read the following fields for an email verification token.
  - operation: Read EVT
    fields:
      - expires_at
      - issued_at
  # Admins and owners can read the following fields for an email verification token.
  - operation: Read EVT
    authenticated: true
    roles:
      - admin
      - owner
    fields:
      - email_id
      - expires_at
      - issued_at
      - user_id
      - verified_at
  # Only owners can update email verification tokens.
  - operation: Update EVT
    authenticated: true
    roles:
      - owner
    fields:
      - verified_at



  # Everyone can read the following fields for an event.
  - operation: Read Event
    fields:
      - created_at
      - id
      - payload
      - public
      - study_id
      - type
      - user_id
  # Admins and owners can read the whole event.
  - operation: Read Event
    authenticated: true
    roles:
      - admin
      - owner
  # Only authenticated users can create events.
  - operation: Create Event
    authenticated: true
    roles:
      - user
    fields:
      - payload
      - public
      - study_id
      - type
      - user_id



  # Everyone can read the following fields for a label.
  - operation: Read Label
    fields:
      - color
      - created_at
      - description
      - id
      - is_default
      - name
      - study_id
      - updated_at
  # Owners can read the whole label.
  - operation: Read Label
    authenticated: true
    roles:
      - admin
      - owner
  # Only owners can create/update/delete labels.
  - operation: Create Label
    authenticated: true
    roles:
      - owner
    fields:
      - color
      - description
      - name
      - study_id
  - operation: Update Label
    authenticated: true
    roles:
      - owner
    fields:
      - color
      - description
  - operation: Delete Label
    authenticated: true
    roles:
      - owner



  # Only owners can connect/disconnect labeled.
  - operation: Connect Labeled 
    authenticated: true
    roles:
      - owner
  - operation: Disconnect Labeled
    authenticated: true
    roles:
      - owner
  # Owners can read the labeled.
  - operation: Read Labeled
    authenticated: true
    roles:
      - user



  # Everyone can read the following fields for a lesson.
  - operation: Read Lesson
    fields:
      - body
      - course_id
      - course_number
      - created_at
      - id
      - number
      - published_at
      - study_id
      - title
      - updated_at
      - user_id
  # Owners can read the whole lesson.
  - operation: Read Lesson
    authenticated: true
    roles:
      - admin
      - owner
  # Only owners can create/update/delete lessons.
  - operation: Create Lesson
    authenticated: true
    roles:
      - owner
    fields:
      - study_id
      - title
      - user_id
  - operation: Update Lesson
    authenticated: true
    roles:
      - owner
    fields:
      - body
      - draft
      - number
      - published_at
      - title
  - operation: Delete Lesson
    authenticated: true
    roles:
      - owner



  # Only owners can read a lesson draft backup.
  - operation: Read LessonDraftBackup
    authenticated: true
    roles:
      - owner



  # Only owners can read a comment draft backup.
  - operation: Read CommentDraftBackup
    authenticated: true
    roles:
      - owner



  # Only owners can read/update/delete notifications.
  - operation: Read Notification
    authenticated: true
    roles:
      - owner
  - operation: Update Notification
    authenticated: true
    roles:
      - owner
    fields:
      - last_read_at
  - operation: Delete Notification
    authenticated: true
    roles:
      - owner



  # Everyone can read the following fields for a password reset token.
  - operation: Read PRT 
    fields:
      - expires_at
      - issued_at
  # Owners can read the following fields for a password reset token.
  - operation: Read PRT
    authenticated: true
    roles:
      - owner
    fields:
      - email_id
      - end_ip
      - ended_at
      - expires_at
      - issued_at
      - request_ip
      - token
      - user_id
  # Admins can read the following fields for a password reset token.
  - operation: Read PRT
    authenticated: true
    roles:
      - admin
    fields:
      - email_id
      - end_ip
      - ended_at
      - expires_at
      - issued_at
      - request_ip
      - user_id
  # Everyone can create password reset tokens.
  - operation: Create PRT
    fields:
      - email_id
      - request_ip
      - user_id
  # Only owners can update password reset tokens.
  - operation: Update PRT
    authenticated: true
    roles:
      - owner
    fields:
      - end_ip
      - ended_at



  # Everyone can read studies.
  - operation: Read Study
  # Only authenticated users can create studies.
  - operation: Create Study
    authenticated: true
    roles:
      - user
    fields:
      - description
      - name
      - user_id
  # Only owners can update/delete studies.
  - operation: Update Study
    authenticated: true
    roles:
      - owner
    fields:
      - description
      - name
  - operation: Delete Study
    authenticated: true
    roles:
      - owner



  # Everyone can read topics.
  - operation: Read Topic

  # Only authenticated users can create topics.
  - operation: Create Topic
    authenticated: true
    roles:
      - user
    fields:
      - name
  # Only admins can update topics.
  - operation: Update Topic
    authenticated: true
    roles:
      - admin
    fields:
      - description



  # Only authenticated users can connect/disconnect topiced.
  - operation: Connect Topiced 
    authenticated: true
    roles:
      - owner
  - operation: Disconnect Topiced
    authenticated: true
    roles:
      - owner
  # Owners can read the topiced.
  - operation: Read Topiced
    authenticated: true
    roles:
      - user



  # Everyone can read the following fields for a user.
  - operation: Read User
    fields:
      - bio
      - created_at
      - id
      - login
      - name
      - profile_email_id
      - profile_updated_at
  # Owners can read the whole user.
  - operation: Read User
    authenticated: true
    roles:
      - owner
  # Everyone can create a user with the following fields.
  - operation: Create User
    fields:
      - login
      - password
      - primary_email
  # Only owners can update/delete users. 
  - operation: Update User
    authenticated: true
    roles:
      - owner
    fields:
      - bio
      - login
      - name
      - password
      - profile_email_id
  - operation: Delete User
    authenticated: true
    roles:
      - owner



  # Everyone can read the following fields for a user asset.
  - operation: Read UserAsset
    fields:
      - activity_id
      - activity_number
      - created_at
      - description
      - id
      - key
      - name
      - published_at
      - size
      - study_id
      - subtype
      - type
      - updated_at
      - user_id 
  # Owners can read the whole user asset.
  - operation: Read UserAsset
    authenticated: true
    roles:
      - admin
      - owner
  # Only authenticated users can create user assets. 
  - operation: Create UserAsset
    authenticated: true
    roles:
      - owner
    fields:
      - asset_id
      - description
      - name
      - study_id
      - user_id
  # Only owners can update/delete user assets. 
  - operation: Update UserAsset
    authenticated: true
    roles:
      - owner
    fields:
      - description
      - name
  - operation: Delete UserAsset
    authenticated: true
    roles:
      - owner