#                                                                        #
# Security policy for the Neos package                                   #
#                                                                        #

privilegeTargets:

  'Neos\Flow\Security\Authorization\Privilege\Method\MethodPrivilege':


    #
    # General access to frontend and backend
    #

    'Neos.Neos:AllControllerActions':
      matcher: 'within(Neos\Flow\Mvc\Controller\AbstractController) && method(public .*->(?!initialize).*Action())'

    'Neos.Neos:WidgetControllers':
      matcher: 'method(Neos\FluidAdaptor\ViewHelpers\Widget\Controller\AutocompleteController->(index|autocomplete)Action()) || method(Neos\FluidAdaptor\ViewHelpers\Widget\Controller\PaginateController->indexAction()) || method(Neos\ContentRepository\ViewHelpers\Widget\Controller\PaginateController->indexAction()) || method(Neos\Neos\ViewHelpers\Widget\Controller\LinkRepositoryController->(index|search|lookup)Action())'

    'Neos.Neos:PublicFrontendAccess':
      matcher: 'method(Neos\Neos\Controller\Frontend\NodeController->showAction())'

    'Neos.Neos:BackendLogin':
      matcher: 'method(Neos\Neos\Controller\LoginController->(index|tokenLogin|authenticate)Action()) || method(Neos\Flow\Security\Authentication\Controller\AbstractAuthenticationController->authenticateAction())'

    'Neos.Neos:Backend.GeneralAccess':
      matcher: 'method(Neos\Neos\Controller\Backend\BackendController->(index|switchSite|xliffAsJson)Action()) || method(Neos\Neos\Controller\Backend\ModuleController->indexAction()) || method(Neos\Neos\Controller\LoginController->logoutAction()) || method(Neos\Flow\Security\Authentication\Controller\AbstractAuthenticationController->logoutAction()) || method(Neos\Neos\Controller\Module\AbstractModuleController->indexAction()) || method(Neos\Neos\Service\Controller\AbstractServiceController->errorAction())'

    #
    # Content access and publishing
    #

    'Neos.Neos:Backend.Module.Content':
      matcher: 'method(Neos\Neos\Controller\Backend\SchemaController->(nodeTypeSchema|vieSchema)Action()) || method(Neos\Neos\Controller\Backend\MenuController->indexAction()) || method(Neos\Neos\Controller\Backend\SettingsController->editPreviewAction())'

    'Neos.Neos:Backend.PersonalWorkspaceReadAccess.NodeConverter':
      matcher: 'method(Neos\Neos\TypeConverter\NodeConverter->prepareContextProperties(workspaceName === current.userInformation.personalWorkspaceName))'

    # No role should have this privilege assigned:
    'Neos.Neos:Backend.OtherUsersPersonalWorkspaceAccess':
      matcher: 'method(Neos\ContentRepository\Domain\Service\Context->validateWorkspace()) && evaluate(this.workspace.owner !== current.userInformation.backendUser, this.workspace.personalWorkspace === true)'

    'Neos.Neos:Backend.EditContent':
      matcher: 'method(Neos\Neos\Service\Controller\NodeController->(show|getPrimaryChildNode|getChildNodesForTree|filterChildNodesForTree|getChildNodes|getChildNodesFromParent|create|createAndRender|createNodeForTheTree|move|moveBefore|moveAfter|moveInto|moveAndRender|copy|copyBefore|copyAfter|copyInto|copyAndRender|update|updateAndRender|delete|searchPage|error)Action()) || method(Neos\Neos\Controller\Backend\ContentController->(uploadAsset|assetsWithMetadata|imageWithMetadata|pluginViews|createImageVariant|masterPlugins|error)Action()) || method(Neos\Neos\Controller\Service\AssetProxiesController->(index|show|import|error)Action()) || method(Neos\Neos\Controller\Service\AssetsController->(index|show|error)Action()) || method(Neos\Neos\Controller\Service\NodesController->(index|show|create|error)Action())'

    'Neos.Neos:Backend.PublishToLiveWorkspace':
      matcher: 'method(Neos\ContentRepository\Domain\Model\Workspace->(publish|publishNode|publishNodes)(targetWorkspace.name === "live"))'

    'Neos.Neos:Backend.PublishAllToLiveWorkspace':
      matcher: 'method(Neos\Neos\Controller\Module\Management\WorkspacesController->publishWorkspaceAction(workspace.baseWorkspace.name === "live"))'

    'Neos.Neos:Backend.PublishOwnWorkspaceContent':
      matcher: 'method(Neos\Neos\Service\Controller\WorkspaceController->(publishNode|publishNodes|error)Action()) || method(Neos\Neos\Service\Controller\WorkspaceController->publishAllAction(workspaceName = current.userInformation.personalWorkspaceName)) || method(Neos\Neos\Service\Controller\WorkspaceController->getWorkspaceWideUnpublishedNodesAction(workspace.name = current.userInformation.personalWorkspaceName))'

    'Neos.Neos:Backend.DiscardOwnWorkspaceContent':
      matcher: 'method(Neos\Neos\Service\Controller\WorkspaceController->(discardNode|discardNodes|error)Action()) || method(Neos\Neos\Service\Controller\WorkspaceController->discardAllAction(workspace.name === current.userInformation.personalWorkspaceName))'

    #
    # Workspace management
    #

    'Neos.Neos:Backend.CreateWorkspaces':
      matcher: 'method(Neos\Neos\Controller\Service\WorkspacesController->(new|create)Action()) || method(Neos\Neos\Controller\Module\Management\WorkspacesController->(create|new)Action())'

    'Neos.Neos:Backend.Module.Management.Workspaces.ManageOwnWorkspaces':
      matcher: 'method(Neos\Neos\Controller\Module\Management\WorkspacesController->(publishWorkspace|discardWorkspace|edit|update|delete)Action(workspace.owner === current.userInformation.backendUser))'

    'Neos.Neos:Backend.Module.Management.Workspaces.ManageInternalWorkspaces':
      matcher: 'method(Neos\Neos\Controller\Module\Management\WorkspacesController->(publishWorkspace|discardWorkspace|edit|update|delete)Action(workspace.owner === null))'

    'Neos.Neos:Backend.Module.Management.Workspaces.ManageAllPrivateWorkspaces':
      matcher: 'method(Neos\Neos\Controller\Module\Management\WorkspacesController->(publishWorkspace|discardWorkspace|edit|update|delete)Action()) && evaluate(this.workspace.owner !== current.userInformation.backendUser, this.workspace.personalWorkspace === false)'

    'Neos.Neos:Backend.Service.Workspaces.Index':
      matcher: 'method(Neos\Neos\Controller\Service\WorkspacesController->(index|error|show)Action())'

    'Neos.Neos:Backend.Service.Workspaces.ManageOwnWorkspaces':
      matcher: 'method(Neos\Neos\Controller\Service\WorkspacesController->(update|delete)Action(workspace.owner === current.userInformation.backendUser))'

    #
    # User management and user settings
    #

    'Neos.Neos:Backend.Module.User.UserSettings.UpdateOwnSettings':
      matcher: 'method(Neos\Neos\Controller\Module\User\UserSettingsController->updateAction(user === current.userInformation.backendUser))'

    'Neos.Neos:Backend.EditUserPreferences':
      matcher: 'method(Neos\Neos\Service\Controller\UserPreferenceController->(index|update|error)Action())'

    #
    # Miscellaneous services
    #

    'Neos.Neos:Backend.ContentDimensions':
      matcher: 'method(Neos\Neos\Controller\Service\ContentDimensionsController->(index|show|error)Action())'

    'Neos.Neos:Backend.DataSource':
      matcher: 'method(Neos\Neos\Service\Controller\DataSourceController->(index|error)Action())'

  #
  # General access to Neos Backend modules
  #

  'Neos\Neos\Security\Authorization\Privilege\ModulePrivilege':

    'Neos.Neos:Backend.Module.User':
      matcher: 'user'

    'Neos.Neos:Backend.Module.User.UserSettings':
      matcher: 'user/usersettings'

    'Neos.Neos:Backend.Module.Management':
      matcher: 'management'

    'Neos.Neos:Backend.Module.Management.Workspaces':
      matcher: 'management/workspaces'

    'Neos.Neos:Backend.Module.Management.History':
      matcher: 'management/history'

    'Neos.Neos:Backend.Module.Administration':
      matcher: 'administration'

    'Neos.Neos:Backend.Module.Administration.Users':
      matcher: 'administration/users'

    'Neos.Neos:Backend.Module.Administration.Packages':
      matcher: 'administration/packages'

    'Neos.Neos:Backend.Module.Administration.Sites':
      matcher: 'administration/sites'

    'Neos.Neos:Backend.Module.Administration.Configuration':
      matcher: 'administration/configuration'

    'Neos.Neos:Backend.Module.Administration.Dimensions':
      matcher: 'administration/dimensions'

roles:

  'Neos.Flow:Everybody':
    privileges:
      -
        privilegeTarget: 'Neos.Neos:PublicFrontendAccess'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:BackendLogin'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:WidgetControllers'
        permission: GRANT


  'Neos.Neos:LivePublisher':
    privileges:
      -
        privilegeTarget: 'Neos.Neos:Backend.PublishToLiveWorkspace'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.PublishAllToLiveWorkspace'
        permission: GRANT

  'Neos.Neos:AbstractEditor':
    abstract: true
    parentRoles: ['Neos.ContentRepository:Administrator']
    privileges:
      -
        privilegeTarget: 'Neos.Neos:Backend.GeneralAccess'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Module.Content'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.PersonalWorkspaceReadAccess.NodeConverter'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.EditContent'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.PublishOwnWorkspaceContent'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.DiscardOwnWorkspaceContent'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Service.Workspaces.Index'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Service.Workspaces.ManageOwnWorkspaces'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Module.Management.Workspaces.ManageOwnWorkspaces'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.CreateWorkspaces'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.ContentDimensions'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.DataSource'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Module.User'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Module.User.UserSettings'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Module.User.UserSettings.UpdateOwnSettings'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.EditUserPreferences'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Module.Management'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Module.Management.Workspaces'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Module.Management.History'
        permission: GRANT

  'Neos.Neos:RestrictedEditor':
    parentRoles: ['Neos.Neos:AbstractEditor']

  'Neos.Neos:Editor':
    parentRoles: ['Neos.Neos:AbstractEditor', 'Neos.Neos:LivePublisher']

  'Neos.Neos:Administrator':
    parentRoles: ['Neos.Neos:Editor']
    privileges:
      -
        privilegeTarget: 'Neos.Neos:Backend.Module.Administration'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Module.Administration.Users'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Module.Administration.Packages'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Module.Management.Workspaces.ManageInternalWorkspaces'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Module.Management.Workspaces.ManageAllPrivateWorkspaces'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Module.Administration.Sites'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Module.Administration.Configuration'
        permission: GRANT

      -
        privilegeTarget: 'Neos.Neos:Backend.Module.Administration.Dimensions'
        permission: GRANT
