First cut at permissions policies

Covers organisations, projects and users.

cadasta/config/permissions/data-collector.json

@@ -0,0 +1,9 @@
+{
+  "clause": [
+    {
+      "effect": "allow",
+      "action": ["project.resources.*"]
+      "object": ["project/$organization/$project"],
+    }
+  ]
+}

cadasta/config/permissions/default.json

@@ -2,12 +2,23 @@
   "clause": [
     {
       "effect": "allow",
-      "object": ["*"],
-      "action": ["org.list"]
-    }, {
+      "action": ["org.list", "org.create"]
+    },
+    {
       "effect": "allow",
-      "object": ["organization/*"],
       "action": ["org.view"]
+      "object": ["organization/*"],
+    },
+
+    {
+      "effect": "allow",
+      "action": ["project.list"],
+      "object": ["organization/*"]
+    },
+    {
+      "effect": "allow",
+      "action": ["project.view"],
+      "object": ["project/*/*"]
     }
-  ]   
+  ]
 }

cadasta/config/permissions/org-admin.json

@@ -2,12 +2,14 @@
   "clause": [
     {
       "effect": "allow",
-      "object": ["*"],
-      "action": ["org.*"]
-    }, {
+      "action": ["org.*", "org.*.*", "project.*", "project.*.*"]
+      "object": ["organization/$organization"],
+    },
+
+    {
       "effect": "allow",
-      "object": ["organization/*"],
-      "action": ["org.*"]
+      "action": ["project.*", "project.*.*"]
+      "object": ["project/$organization/*"],
     }
-  ]   
+  ]
 }

cadasta/config/permissions/project-manager.json

@@ -0,0 +1,14 @@
+{
+  "clause": [
+    {
+      "effect": "allow",
+      "action": ["project.*", "project.*.*"]
+      "object": ["project/$organization/$project"],
+    },
+    {
+      "effect": "deny",
+      "action": ["project.archive", "project.unarchive"]
+      "object": ["project/$organization/$project"],
+    }
+  ]
+}

cadasta/config/permissions/project-user.json

@@ -0,0 +1,13 @@
+{
+  "clause": [
+    {
+      "effect": "allow",
+      "action": ["org.list", "org.create"]
+    },
+    {
+      "effect": "allow",
+      "object": ["organization/*"],
+      "action": ["org.view"]
+    }
+  ]
+}

cadasta/config/permissions/superuser.json

@@ -2,8 +2,33 @@
   "clause": [
     {
       "effect": "allow",
-      "object": ["organization/*"],
       "action": ["org.*"]
+    },
+    {
+      "effect": "allow",
+      "action": ["org.*", "org.*.*"]
+      "object": ["organization/*"],
+    },
+
+    {
+      "effect": "allow",
+      "action": ["project.*", "project.*.*"]
+      "object": ["organization/*"],
+    },
+    {
+      "effect": "allow",
+      "action": ["project.*", "project.*.*"]
+      "object": ["project/*/*"],
+    },
+
+    {
+      "effect": "allow",
+      "action": ["user.*"]
+    },
+    {
+      "effect": "allow",
+      "action": ["user.*"]
+      "object": ["user/*"],
     }
   ]
 }