Comments and cleanup

cadasta/config/permissions/data-collector.json

@@ -1,9 +1,12 @@
 {
   "clause": [
+    // In addition to the permissions provided by the default
+    // policy, data collectors are allowed to manage resources for a
+    // specified project within a specified organization.
     {
       "effect": "allow",
       "action": ["project.resources.*"],
-      "object": ["project/$organization/$project"],
+      "object": ["project/$organization/$project"]
     }
   ]
 }

cadasta/config/permissions/default.json

@@ -1,21 +1,28 @@
 {
   "clause": [
     {
+      // Any user is allowed to list organizations and create new
+      // ones.
       "effect": "allow",
       "action": ["org.list", "org.create"]
     },
     {
+      // Any user is allowed to view the details of an organization.
       "effect": "allow",
       "action": ["org.view"],
-      "object": ["organization/*"],
+      "object": ["organization/*"]
     },
 
     {
+      // Any user is allowed to list the public projects in an
+      // organization.
       "effect": "allow",
       "action": ["project.list"],
       "object": ["organization/*"]
     },
     {
+      // Any user is allowed to view the details of public projects in
+      // an organization.
       "effect": "allow",
       "action": ["project.view"],
       "object": ["project/*/*"]

cadasta/config/permissions/org-admin.json

@@ -1,15 +1,20 @@
 {
   "clause": [
+    // In addition to the permissions provided by the default
+    // policy, organization administrators are allowed to perform all
+    // organization management actions for a specified organization,
+    // and all project management actions for all projects within a
+    // specified organization.
     {
       "effect": "allow",
       "action": ["org.*", "org.*.*", "project.*", "project.*.*"],
-      "object": ["organization/$organization"],
+      "object": ["organization/$organization"]
     },
 
     {
       "effect": "allow",
       "action": ["project.*", "project.*.*"],
-      "object": ["project/$organization/*"],
+      "object": ["project/$organization/*"]
     }
   ]
 }

cadasta/config/permissions/project-manager.json

@@ -1,14 +1,19 @@
 {
   "clause": [
+    // In addition to the permissions provided by the default
+    // policy, project managers are allowed to perform all project
+    // management actions, except for project archiving and
+    // unarchiving, for a specified project within a specified
+    // organization.
     {
       "effect": "allow",
       "action": ["project.*", "project.*.*"],
-      "object": ["project/$organization/$project"],
+      "object": ["project/$organization/$project"]
     },
     {
       "effect": "deny",
       "action": ["project.archive", "project.unarchive"],
-      "object": ["project/$organization/$project"],
+      "object": ["project/$organization/$project"]
     }
   ]
 }

cadasta/config/permissions/project-user.json

@@ -1,13 +1,8 @@
 {
   "clause": [
-    {
-      "effect": "allow",
-      "action": ["org.list", "org.create"]
-    },
-    {
-      "effect": "allow",
-      "object": ["organization/*"],
-      "action": ["org.view"]
-    }
+    // Currently, "ordinary" users associated with a project have no
+    // additional permissions over those given to all users.  This may
+    // change in the future.  In particular, project users may be
+    // permitted access to projects that are normally private.
   ]
 }

cadasta/config/permissions/superuser.json

@@ -1,24 +1,26 @@
 {
   "clause": [
+    // A superuser is permitted to perform all actions on all entities
+    // within the platform.
     {
       "effect": "allow",
       "action": ["org.*"]
     },
     {
       "effect": "allow",
       "action": ["org.*", "org.*.*"],
-      "object": ["organization/*"],
+      "object": ["organization/*"]
     },
 
     {
       "effect": "allow",
       "action": ["project.*", "project.*.*"],
-      "object": ["organization/*"],
+      "object": ["organization/*"]
     },
     {
       "effect": "allow",
       "action": ["project.*", "project.*.*"],
-      "object": ["project/*/*"],
+      "object": ["project/*/*"]
     },
 
     {
@@ -28,7 +30,7 @@
     {
       "effect": "allow",
       "action": ["user.*"],
-      "object": ["user/*"],
+      "object": ["user/*"]
     }
   ]
 }