<?xml version="1.0" encoding="UTF-8"?>
<PolicySet
  PolicySetId="urn:oasis:names:tc:ebxml-regrep:3.0:rim:acp:policy:rootFolderACP" 
  PolicyCombiningAlgId="urn:oasis:names:tc:xacml:1.0:policy-combining-algorithm:permit-overrides"
  xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os"
  xmlns:xacml-context="urn:oasis:names:tc:xacml:2.0:context:schema:os"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
  xsi:schemaLocation="urn:oasis:names:tc:xacml:2.0:policy:schema:os http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-policy-schema-os.xsd">
  <Description>This PolicySet restricts adding members to RegistryPackage resource to Role ProjectLead</Description>
  <Target>
  </Target>
  <PolicyIdReference>urn:oasis:names:tc:ebxml-regrep:3.0:rim:acp:policy:policyid:permit-anyone-to-read</PolicyIdReference>
  <PolicyIdReference>urn:oasis:names:tc:ebxml-regrep:3.0:rim:acp:policy:policyid:permit-owner-all</PolicyIdReference>
  <PolicyIdReference>urn:oasis:names:tc:ebxml-regrep:3.0:rim:acp:policy:policyid:permit-registryadministrator-all</PolicyIdReference>
  <Policy PolicyId="urn:oasis:names:tc:ebxml-regrep:3.0:rim:acp:policy:permit-projectLead-addMember" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides">
    <Description>Allow Subjects with ProjectLead role to add members to any resource associated with this ACP.</Description>
    <Target>
    </Target>
    <Rule RuleId="urn:oasis:names:tc:ebxml-regrep:3.0:rim:acp:rule:ruleid:permit-registryAdmin-addMember-rule" Effect="Permit">
      <Description>Allow Subjects with ProjectLead role to add members to any resource.</Description>
      <Target>
        <Subjects>
          <Subject>
            <!-- Match role RegistryAdministrator -->
            <SubjectMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
              <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">/urn:oasis:names:tc:ebxml-regrep:classificationScheme:SubjectRole/RegistryAdministrator</AttributeValue>
              <SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:ebxml-regrep:3.0:rim:acp:subject:role" DataType="http://www.w3.org/2001/XMLSchema#string"/>
            </SubjectMatch>
          </Subject>
        </Subjects>
        <Actions>
          <Action>
            <!-- Match "reference" action -->
            <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
              <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">reference</AttributeValue>
              <ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
            </ActionMatch>
          </Action>
        </Actions>
      </Target>
      <!--
           Match condition where all the following are true:
           1. reference is being made via the attribute sourceObject (from an Association instance)
           2. The associationType attribute of the Association matches the id for associationType HasMameber
           
           Above is equivalent to saying Match any HasMember associations where the resource
           (the RegistryPackage) is the sourceObject.
      -->
      <Condition>
        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
          <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">SourceObject</AttributeValue>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
              <ActionAttributeDesignator AttributeId="urn:oasis:names:tc:ebxml-regrep:3.0:rim:acp:action:reference-source-attribute" DataType="http://www.w3.org/2001/XMLSchema#string"/>
            </Apply>
          </Apply>
          <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:ebxml-regrep:AssociationType:HasMember</AttributeValue>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:anyURI-one-and-only">
              <ActionAttributeDesignator AttributeId="urn:oasis:names:tc:ebxml-regrep:3.0:rim:acp:action:reference-source-attribute-filter:associationType" DataType="http://www.w3.org/2001/XMLSchema#anyURI"/>
            </Apply>
          </Apply>
        </Apply>
      </Condition>
    </Rule>
  </Policy>
</PolicySet>
