<commit_before><?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2016 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->
<role oid="408be7b4-e502-11e5-9cd2-3c970e44b9e2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
	xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
	xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
        xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
        xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3">
    <name>Customer End User Role</name>
    <description>End user role for normal users.</description>
<!-- ***** GUI ***** -->

<!-- ***** From End User role (fragments) ***** -->

    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfAll</action>
    </authorization>
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <special>self</special>
        </object>
    </authorization>
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>ShadowType</type>
            <owner>
                <special>self</special>
            </owner>
        </object>
    </authorization>
    <authorization>
    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#changeCredentials</action>
    	<phase>request</phase>
    	<object>
    		<special>self</special>
    	</object>
    	<item>credentials</item>
    </authorization>
    <authorization>
    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#changeCredentials</action>
    	<phase>request</phase>
    	<object>
    		<type>ShadowType</type>
    		<owner>
    			<special>self</special>
    		</owner>
    	</object>
    	<item>credentials</item>
    </authorization>
    <authorization>
    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
    	<phase>execution</phase>
    	<object>
    		<special>self</special>
    	</object>
    	<item>credentials</item>
    </authorization>
    <authorization>
    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
    	<phase>execution</phase>
    	<object>
    		<type>ShadowType</type>
    		<owner>
    			<special>self</special>
    		</owner>
    	</object>
    	<item>credentials</item>
    </authorization>

    <authorization>
	<name>Read for all resources, all organizations and roles of roleType=customer and End User</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>OrgType</type>
        </object>
        <object>
            <type>ResourceType</type>
        </object>
        <object>
            <type>RoleType</type>
            <filter>
                 <q:or>
                    <q:equal>
                            <q:path>roleType</q:path>
                            <q:value>customer</q:value>
                    </q:equal>
                    <q:equal>
                            <q:path>name</q:path>
                            <q:value>End user</q:value>
                    </q:equal>
               </q:or>
            </filter>
        </object>
    </authorization>
    <authorization><!-- XXX XXX still roles can be "assigned" in GUI (will fail in model)-->
<!-- https://jira.evolveum.com/browse/MID-2146 -->
	<name>Do not allow to assign anything for self</name>
	<decision>deny</decision>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#assign</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#unassign</action>
 	<phase>request</phase>
        <object>
            <type>RoleType</type>
        </object>
    </authorization>
    <requestable>false</requestable>
    <roleType>customer</roleType>
</role><commit_msg>Another fix for delegated administration<commit_after><?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2016 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->
<role oid="408be7b4-e502-11e5-9cd2-3c970e44b9e2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
	xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
	xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
        xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
        xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3">
    <name>Customer End User Role</name>
    <description>End user role for normal users.</description>
<!-- ***** GUI ***** -->

<!-- ***** From End User role (fragments) ***** -->

    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfDashboard</action>
    </authorization>
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfProfile</action>
    </authorization>
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfCredentials</action>
    </authorization>
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <special>self</special>
        </object>
    </authorization>
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>ShadowType</type>
            <owner>
                <special>self</special>
            </owner>
        </object>
    </authorization>
    <authorization>
    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#changeCredentials</action>
    	<phase>request</phase>
    	<object>
    		<special>self</special>
    	</object>
    	<item>credentials</item>
    </authorization>
    <authorization>
    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#changeCredentials</action>
    	<phase>request</phase>
    	<object>
    		<type>ShadowType</type>
    		<owner>
    			<special>self</special>
    		</owner>
    	</object>
    	<item>credentials</item>
    </authorization>
    <authorization>
    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
    	<phase>execution</phase>
    	<object>
    		<special>self</special>
    	</object>
    	<item>credentials</item>
    </authorization>
    <authorization>
    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
    	<phase>execution</phase>
    	<object>
    		<type>ShadowType</type>
    		<owner>
    			<special>self</special>
    		</owner>
    	</object>
    	<item>credentials</item>
    </authorization>

<!-- XXX Authorization to read own organization and its content including the path from root ... -->
    <authorization>
	<name>Magic read only</name>
	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <orgRelation>
<!--                <subjectRelation>org:manager</subjectRelation>-->
                <scope>allDescendants</scope>
                <includeReferenceOrg>true</includeReferenceOrg>
            </orgRelation>
        </object>
    </authorization>

    <authorization>
	<name>Read for all resources and roles of roleType=customer and End User</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>ResourceType</type>
        </object>
        <object>
            <type>RoleType</type>
            <filter>
                 <q:or>
                    <q:equal>
                            <q:path>roleType</q:path>
                            <q:value>customer</q:value>
                    </q:equal>
                    <q:equal>
                            <q:path>name</q:path>
                            <q:value>End user</q:value>
                    </q:equal>
               </q:or>
            </filter>
        </object>
    </authorization>
    <authorization><!-- XXX XXX still roles can be "assigned" in GUI (will fail in model)-->
<!-- https://jira.evolveum.com/browse/MID-2146 -->
	<name>Do not allow to assign anything for self</name>
	<decision>deny</decision>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#assign</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#unassign</action>
 	<phase>request</phase>
        <object>
            <type>RoleType</type>
        </object>
    </authorization>

    <requestable>false</requestable>
    <roleType>customer</roleType>
</role>
{'fraction_non_alphanumeric': 0.15042768655982697, 'fraction_numerical': 0.011306656179333399, 'mean_word_length': 2.4835616438356163, 'pattern_counts': {'":': 0, '<': 317, '<?xml version=': 2, '>': 317, 'https://': 2, 'lorem ipsum': 0, 'www.': 4, 'xml': 47}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3438599', 'n_tokens_mistral': 3320, 'n_tokens_neox': 3233, 'n_words': 505}