<commit_before># 
#    Portions Copyright (c) 2009-10 Zepheira LLC, Some Rights Reserved
#    Portions Copyright (c) 2010-11 Talis Inc, Some Rights Reserved
# 
#    Licensed under the Apache License, Version 2.0 (the "License");
#    you may not use this file except in compliance with the License.
#    You may obtain a copy of the License at
# 
#        http://www.apache.org/licenses/LICENSE-2.0
# 
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS,
#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#    See the License for the specific language governing permissions and
#    limitations under the License.

@prefix xsd:<http://www.w3.org/2001/XMLSchema#>.
@prefix rdf:<http://www.w3.org/1999/02/22-rdf-syntax-ns#>.
@prefix rdfs:<http://www.w3.org/2000/01/rdf-schema#>.
@prefix owl:<http://www.w3.org/2002/07/owl#>.
@prefix dcterms:<http://purl.org/dc/terms/>.
@prefix msg:<http://www.openrdf.org/rdf/2011/messaging#>.
@prefix audit:<http://www.openrdf.org/rdf/2009/auditing#>.
@prefix calli:<http://callimachusproject.org/rdf/2009/framework#>.
@prefix foaf:<http://xmlns.com/foaf/0.1/>.
@prefix :<#>.

# Transaction operations must be authenticated
audit:Transaction a owl:Class; msg:realm </accounts>.

################################
# Authorization
################################

# interface method used by DigestRealmSupport
:AuthorizeCredential rdfs:subClassOf msg:Message;
	rdfs:subClassOf [owl:onProperty msg:target; owl:hasValue </accounts>];
	rdfs:subClassOf [owl:onProperty msg:literal; owl:cardinality "1"^^xsd:nonNegativeInteger];
	rdfs:subClassOf [owl:onProperty msg:literal; owl:allValuesFrom xsd:boolean].

:credential a owl:ObjectProperty, owl:FunctionalProperty;
	rdfs:domain :AuthorizeCredential.

:method a owl:DatatypeProperty, owl:FunctionalProperty;
	rdfs:domain :AuthorizeCredential;
	rdfs:range xsd:string;.

:object a owl:ObjectProperty, owl:FunctionalProperty;
	rdfs:domain :AuthorizeCredential.

:query a owl:DatatypeProperty, owl:FunctionalProperty;
	rdfs:domain :AuthorizeCredential;
	rdfs:range xsd:string.

# users associated with the object are authorized
:AuthorizeIndividual owl:equivalentClass :AuthorizeCredential;
	msg:sparql  """
		ASK {
			{
				{
					$object calli:reader $credential
				} UNION {
					$object calli:contributor $credential
				} UNION {
					$object calli:editor $credential
				}
				FILTER ($method = "GET" || $method = "HEAD" || $method = "POST" && $query = "discussion")
				FILTER (!bound($query) || $query = "view" || $query = "discussion" || $query = "history"
					|| $query = "whatlinkshere" || $query = "relatedchanges")
			} UNION {
				{
					$object calli:contributor $credential
				} UNION {
					$object calli:editor $credential
				}
				FILTER ($method = "GET" || $method = "HEAD" || $method = "POST")
				FILTER (regex($query, "^copy(=|&|$)|^create(=|&|$)"))
			} UNION {
				$object calli:editor $credential
				FILTER ($method = "GET" || $method = "HEAD" || $method = "POST" || $method = "PUT" || $method = "DELETE")
				FILTER (!bound($query) || $query = "edit")
			} UNION {
				$object calli:administrator $credential
			}
		}
	""".

# members of groups associated with the object are authorized
:AuthorizeMember owl:equivalentClass :AuthorizeCredential;
	msg:sparql  """
		ASK {
			?group calli:member $credential
			{
				{
					$object calli:reader ?group
				} UNION {
					$object calli:contributor ?group
				} UNION {
					$object calli:editor ?group
				}
				FILTER ($method = "GET" || $method = "HEAD" || $method = "POST" && $query = "discussion")
				FILTER (!bound($query) || $query = "view" || $query = "discussion" || $query = "history"
					|| $query = "whatlinkshere" || $query = "relatedchanges")
			} UNION {
				{
					$object calli:contributor ?group
				} UNION {
					$object calli:editor ?group
				}
				FILTER ($method = "GET" || $method = "HEAD" || $method = "POST")
				FILTER (regex($query, "^copy(=|&|$)|^create(=|&|$)"))
			} UNION {
				$object calli:editor ?group
				FILTER ($query = "edit" && ($method = "GET" || $method = "HEAD" || $method = "POST"))
				FILTER (!bound($query) && ($method = "PUT" || $method = "DELETE"))
			} UNION {
				$object calli:administrator ?group
			}
		}
	""".

# users or groups associated as reader of a class of the object are authorized
:AuthorizeReader owl:equivalentClass :AuthorizeCredential;
	msg:precedes :AuthorizeCreator;
	msg:script <authorization.js#isReader>.

# users or groups associated as editor of a class of the object are authorized
:AuthorizeCreator owl:equivalentClass :AuthorizeCredential;
	msg:precedes :AuthorizeEditor;
	msg:script <authorization.js#isCreator>.

# users or groups associated as editor of a class of the object are authorized
:AuthorizeEditor owl:equivalentClass :AuthorizeCredential;
	msg:precedes :AuthorizeAdministrator;
	msg:script <authorization.js#isEditor>.

# users or groups associated as editor of a class of the object are authorized
:AuthorizeAdministrator owl:equivalentClass :AuthorizeCredential;
	msg:script <authorization.js#isAdministrator>.

# anybody with credentials can login and is welcome
:AuthorizeLoginPage owl:equivalentClass :AuthorizeCredential;
	msg:sparql  """
		ASK {
			$object calli:authenticates [calli:member $credential]
			FILTER ($method = "GET" || $method = "HEAD")
			FILTER ($object = </accounts>)
			FILTER ($query = "login" || $query = "settings" || $query = "contributions")
		}
	""".

# Users can view resized images or photos if they can view the image itself
:AuthorizeImageResize owl:equivalentClass </accounts/authorization.ttl#AuthorizeCredential>;
	msg:imports foaf:Image;
	msg:script  """
		if (query == "large" || query == "medium" || query == "small") {
			if (method == "GET" || method == "HEAD") {
				if (object instanceof Image) {
					if (this.AuthorizeCredential(credential, method, object, null))
						return true;
				}
			}
		}
		return proceed();
	""".

# transcations are authorized by the object they modified
:AuthorizeTransactionView owl:equivalentClass :AuthorizeCredential;
	msg:script <authorization.js#isViewingTransaction>.

# called from authorization.js#isViewingTransaction
:ListSubjectsOfTransaction rdfs:subClassOf msg:Message;
	rdfs:subClassOf [owl:onProperty msg:target; owl:hasValue </accounts>];
	msg:sparql  """<commit_msg>Allow administrators to view the changeset triples<commit_after># 
#    Portions Copyright (c) 2009-10 Zepheira LLC, Some Rights Reserved
#    Portions Copyright (c) 2010-11 Talis Inc, Some Rights Reserved
# 
#    Licensed under the Apache License, Version 2.0 (the "License");
#    you may not use this file except in compliance with the License.
#    You may obtain a copy of the License at
# 
#        http://www.apache.org/licenses/LICENSE-2.0
# 
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS,
#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#    See the License for the specific language governing permissions and
#    limitations under the License.

@prefix xsd:<http://www.w3.org/2001/XMLSchema#>.
@prefix rdf:<http://www.w3.org/1999/02/22-rdf-syntax-ns#>.
@prefix rdfs:<http://www.w3.org/2000/01/rdf-schema#>.
@prefix owl:<http://www.w3.org/2002/07/owl#>.
@prefix dcterms:<http://purl.org/dc/terms/>.
@prefix msg:<http://www.openrdf.org/rdf/2011/messaging#>.
@prefix audit:<http://www.openrdf.org/rdf/2009/auditing#>.
@prefix calli:<http://callimachusproject.org/rdf/2009/framework#>.
@prefix foaf:<http://xmlns.com/foaf/0.1/>.
@prefix :<#>.

# Transaction operations must be authenticated
audit:Transaction a owl:Class; msg:realm </accounts>.

################################
# Authorization
################################

# interface method used by DigestRealmSupport
:AuthorizeCredential rdfs:subClassOf msg:Message;
	rdfs:subClassOf [owl:onProperty msg:target; owl:hasValue </accounts>];
	rdfs:subClassOf [owl:onProperty msg:literal; owl:cardinality "1"^^xsd:nonNegativeInteger];
	rdfs:subClassOf [owl:onProperty msg:literal; owl:allValuesFrom xsd:boolean].

:credential a owl:ObjectProperty, owl:FunctionalProperty;
	rdfs:domain :AuthorizeCredential.

:method a owl:DatatypeProperty, owl:FunctionalProperty;
	rdfs:domain :AuthorizeCredential;
	rdfs:range xsd:string;.

:object a owl:ObjectProperty, owl:FunctionalProperty;
	rdfs:domain :AuthorizeCredential.

:query a owl:DatatypeProperty, owl:FunctionalProperty;
	rdfs:domain :AuthorizeCredential;
	rdfs:range xsd:string.

# users associated with the object are authorized
:AuthorizeIndividual owl:equivalentClass :AuthorizeCredential;
	msg:sparql  """
		ASK {
			{
				{
					$object calli:reader $credential
				} UNION {
					$object calli:contributor $credential
				} UNION {
					$object calli:editor $credential
				}
				FILTER ($method = "GET" || $method = "HEAD" || $method = "POST" && $query = "discussion")
				FILTER (!bound($query) || $query = "view" || $query = "discussion" || $query = "history"
					|| $query = "whatlinkshere" || $query = "relatedchanges")
			} UNION {
				{
					$object calli:contributor $credential
				} UNION {
					$object calli:editor $credential
				}
				FILTER ($method = "GET" || $method = "HEAD" || $method = "POST")
				FILTER (regex($query, "^copy(=|&|$)|^create(=|&|$)"))
			} UNION {
				$object calli:editor $credential
				FILTER ($method = "GET" || $method = "HEAD" || $method = "POST" || $method = "PUT" || $method = "DELETE")
				FILTER (!bound($query) || $query = "edit")
			} UNION {
				$object calli:administrator $credential
			}
		}
	""".

# members of groups associated with the object are authorized
:AuthorizeMember owl:equivalentClass :AuthorizeCredential;
	msg:sparql  """
		ASK {
			?group calli:member $credential
			{
				{
					$object calli:reader ?group
				} UNION {
					$object calli:contributor ?group
				} UNION {
					$object calli:editor ?group
				}
				FILTER ($method = "GET" || $method = "HEAD" || $method = "POST" && $query = "discussion")
				FILTER (!bound($query) || $query = "view" || $query = "discussion" || $query = "history"
					|| $query = "whatlinkshere" || $query = "relatedchanges")
			} UNION {
				{
					$object calli:contributor ?group
				} UNION {
					$object calli:editor ?group
				}
				FILTER ($method = "GET" || $method = "HEAD" || $method = "POST")
				FILTER (regex($query, "^copy(=|&|$)|^create(=|&|$)"))
			} UNION {
				$object calli:editor ?group
				FILTER ($query = "edit" && ($method = "GET" || $method = "HEAD" || $method = "POST"))
				FILTER (!bound($query) && ($method = "PUT" || $method = "DELETE"))
			} UNION {
				$object calli:administrator ?group
			}
		}
	""".

# users or groups associated as reader of a class of the object are authorized
:AuthorizeReader owl:equivalentClass :AuthorizeCredential;
	msg:precedes :AuthorizeCreator;
	msg:script <authorization.js#isReader>.

# users or groups associated as editor of a class of the object are authorized
:AuthorizeCreator owl:equivalentClass :AuthorizeCredential;
	msg:precedes :AuthorizeEditor;
	msg:script <authorization.js#isCreator>.

# users or groups associated as editor of a class of the object are authorized
:AuthorizeEditor owl:equivalentClass :AuthorizeCredential;
	msg:precedes :AuthorizeAdministrator;
	msg:script <authorization.js#isEditor>.

# users or groups associated as editor of a class of the object are authorized
:AuthorizeAdministrator owl:equivalentClass :AuthorizeCredential;
	msg:script <authorization.js#isAdministrator>.

# anybody with credentials can login and is welcome
:AuthorizeLoginPage owl:equivalentClass :AuthorizeCredential;
	msg:sparql  """
		ASK {
			$object calli:authenticates [calli:member $credential]
			FILTER ($method = "GET" || $method = "HEAD")
			FILTER ($object = </accounts>)
			FILTER ($query = "login" || $query = "settings" || $query = "contributions")
		}
	""".

# Users can view resized images or photos if they can view the image itself
:AuthorizeImageResize owl:equivalentClass </accounts/authorization.ttl#AuthorizeCredential>;
	msg:imports foaf:Image;
	msg:script  """
		if (query == "large" || query == "medium" || query == "small") {
			if (method == "GET" || method == "HEAD") {
				if (object instanceof Image) {
					if (this.AuthorizeCredential(credential, method, object, null))
						return true;
				}
			}
		}
		return proceed();
	""".

# transcations are authorized by the object they modified
:AuthorizeTransactionView owl:equivalentClass :AuthorizeCredential;
	msg:script <authorization.js#isViewingTransaction>.

# transcations are authorized by the object they modified
:AuthorizeTransaction owl:equivalentClass :AuthorizeCredential;
	msg:sparql  """
		ASK {
			{
				# they created this transaction
				$object audit:contributor $credential
			} UNION {
				# they administer the user that did this
				$object audit:contributor [calli:administrator $credential]
			} UNION {
				# they are part of a group that administers the user that did this
				$object audit:contributor [calli:administrator [calli:member $credential]]
			}
		}
	""".

# called from authorization.js#isViewingTransaction
:ListSubjectsOfTransaction rdfs:subClassOf msg:Message;
	rdfs:subClassOf [owl:onProperty msg:target; owl:hasValue </accounts>];
	msg:sparql  """
{'fraction_non_alphanumeric': 0.1450074515648286, 'fraction_numerical': 0.008792846497764531, 'mean_word_length': 4.405155054369714, 'pattern_counts': {'":': 0, '<': 43, '<?xml version=': 0, '>': 43, 'https://': 0, 'lorem ipsum': 0, 'www.': 14, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '346614', 'n_tokens_mistral': 4840, 'n_tokens_neox': 4254, 'n_words': 1131}