permission.ascl

/**
 * Access control rules for EHR-network
*/ 
rule DoctorCanReadPatient{
	description: "Allow doctor read access to all granted patients"
    participant(p): "org.acme.biznet.Doctor"
    operation: READ
    resource(r): "org.acme.biznet.Patient"
    condition: (r.authorized && r.authorized.indexOf(r.getIdentifier())>-1) 
  	action: ALLOW
}
rule DoctorCanUpdateEHR{
	description: "Allow doctor update access to all granted patients"
    participant(p): "org.acme.biznet.Doctor"
    operation: CREATE,UPDATE
    resource(r): "org.acme.biznet.Patient"
  	transaction(tx):"org.acme.biznet.UpdateRecord"
    condition: (r.authorized && r.authorized.indexOf(p.getIdentifier())>-1) 
  	action: ALLOW
}
/*rule PatientCanReadEHR{
	description: "Allow patient read access to his/her own records"
    participant(p): "org.acme.biznet.Patient"
    operation: READ
    resource(r): "org.acme.biznet.Medical_Record"
    condition: (p.PatientId == r.PatientId) 
  	action: ALLOW
}
*/
rule DoctorCanReadEHR{
	description: "Allow doctor read access to all of the medical records associated with him"
    participant(p): "org.acme.biznet.Doctor"
    operation: READ
    resource(r): "org.acme.biznet.Medical_Record"
    condition: (p.DoctorID == r.DoctorId)
  	action: ALLOW
}
rule NetworkAdminUser {
    description: "Grant business network administrators full access to user resources"
    participant: "org.hyperledger.composer.system.NetworkAdmin"
    operation: ALL
    resource: "**"
    action: ALLOW
}

rule NetworkAdminSystem {
    description: "Grant business network administrators full access to system resources"
    participant: "org.hyperledger.composer.system.NetworkAdmin"
    operation: ALL
    resource: "org.hyperledger.composer.system.**"
    action: ALLOW
}
rule SystemACL {
  description:  "System ACL to permit all access"
  participant: "ANY"
  operation: ALL
  resource: "org.hyperledger.composer.system.**"
  action: ALLOW
}