salix/db/changes/231601/00-useSpecificsAcls.sql

INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
    VALUES
        ('Ticket', 'editDiscount', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
        ('Ticket', 'editDiscount', 'WRITE', 'ALLOW', 'ROLE', 'salesPerson'),
        ('Ticket', 'hasRoleAdvanced', '*', 'ALLOW', 'ROLE', 'salesAssistant'),
        ('Ticket', 'hasRoleAdvanced', '*', 'ALLOW', 'ROLE', 'deliveryBoss'),
        ('Ticket', 'hasRoleAdvanced', '*', 'ALLOW', 'ROLE', 'buyer'),
        ('Ticket', 'hasRoleAdvanced', '*', 'ALLOW', 'ROLE', 'claimManager'),
        ('Ticket', 'deleteTicketWithPartPrepared', 'WRITE', 'ALLOW', 'ROLE', 'salesAssistant'),
        ('Ticket', 'editZone', 'WRITE', 'ALLOW', 'ROLE', 'deliveryBoss'),
        ('State', 'editableStates', 'READ', 'ALLOW', 'ROLE', 'employee'),
        ('State', 'seeEditableStates', 'READ', 'ALLOW', 'ROLE', 'administrative'),
        ('State', 'seeEditableStates', 'READ', 'ALLOW', 'ROLE', 'production'),
        ('State', 'seeFilteredEditableStates', 'READ', 'ALLOW', 'ROLE', 'salesPerson'),
        ('State', 'isSomeEditable', 'READ', 'ALLOW', 'ROLE', 'salesPerson'),
        ('State', 'isAllEditable', 'READ', 'ALLOW', 'ROLE', 'production'),
        ('State', 'isAllEditable', 'READ', 'ALLOW', 'ROLE', 'administrative'),
        ('Agency', 'seeExpired', 'READ', 'ALLOW', 'ROLE', 'administrative'),
        ('Agency', 'seeExpired', 'READ', 'ALLOW', 'ROLE', 'productionBoss'),
        ('Claim', 'createAfterDeadline', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
        ('Client', 'editAddressLogifloraAllowed', 'WRITE', 'ALLOW', 'ROLE', 'salesAssistant'),
        ('Client', 'editFiscalDataWithoutTaxDataCheck', 'WRITE', 'ALLOW', 'ROLE', 'salesAssistant'),
        ('Client', 'editVerifiedDataWithoutTaxDataCheck', 'WRITE', 'ALLOW', 'ROLE', 'salesAssistant'),
        ('Client', 'editCredit', 'WRITE', 'ALLOW', 'ROLE', 'financialBoss'),
        ('Client', 'isNotEditableCredit', 'WRITE', 'ALLOW', 'ROLE', 'financialBoss'),
        ('InvoiceOut', 'canCreatePdf', 'WRITE', 'ALLOW', 'ROLE', 'invoicing'),
        ('Supplier', 'editPayMethodCheck', 'WRITE', 'ALLOW', 'ROLE', 'financial'),
        ('Worker', 'isTeamBoss', 'WRITE', 'ALLOW', 'ROLE', 'teamBoss'),
        ('Worker', 'forceIsSubordinate', 'READ', 'ALLOW', 'ROLE', 'hr'),
        ('Claim', 'editState', 'WRITE', 'ALLOW', 'ROLE', 'claimManager'),
        ('Claim', 'filter', 'READ', 'ALLOW', 'ROLE', 'employee');

DELETE FROM `salix`.`ACL`
    WHERE
        model = 'Claim'
        AND property = '*'
        AND accessType = '*';

DELETE FROM `salix`.`ACL`
    WHERE
        model = 'Ticket'
        AND property = '*'
        AND accessType = '*';

DELETE FROM `salix`.`ACL`
    WHERE
        model = 'State'
        AND property = '*'
        AND accessType = 'READ';

DELETE FROM `salix`.`ACL`
    WHERE
        model = 'Worker'
        AND property = '*'
        AND accessType = 'READ';

INSERT INTO `salix`.`ACL` (`model`, `property`, `accessType`, `permission`, `principalType`, `principalId`)
    VALUES
        ('State', 'find', 'READ', 'ALLOW', 'ROLE', 'employee'),
        ('State', 'findById', 'READ', 'ALLOW', 'ROLE', 'employee'),
        ('State', 'findOne', 'READ', 'ALLOW', 'ROLE', 'employee');