<?xml version="1.0" encoding="UTF-8"?>
<Policy
xmlns="http://www.rubix.com/2008/RXSPMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.rubix.com/2008/RXSPMLSchema ../common-scripts/RXSPMLSchema.xsd"
PolicyId="user-table-sel-del-upd" 
RuleCombiningAlgId="ordered-permit-overrides">
	<Description>
		For all row-select and row-delete operations:
		Allow operation only by creator (if subject-name equals name column).
		For all row-update operations:
		Allow operation only by creator (if subject-name equals name column)
		and name column is not being updated.
	</Description>
	<Target/>
	
	<VariableDefinition VariableId="is-creator">
		<Apply FunctionId="equal">
				<SubjectAttributeDesignator AttributeId="subject-name"/>
				<AttributeSelector RequestContextPath="db.cat.sch.tab.name" DataType="string"/>
		</Apply>
	</VariableDefinition>
	
	<Rule RuleId="select-delete-rule" Effect="Permit">
	<Description>
		For all row-select and row-delete operations:
		Allow operation only by creator (if subject-name equals name column).
	</Description>
	<Target> <Actions> 
		<Action> <ActionMatch MatchId="equal">
				<AttributeValue DataType="string">row-select</AttributeValue>
				<ActionAttributeDesignator AttributeId="action-id"/>
		</ActionMatch></Action>
		<Action> <ActionMatch MatchId="equal">
			<AttributeValue DataType="string">row-delete</AttributeValue>
			<ActionAttributeDesignator AttributeId="action-id"/>
		</ActionMatch></Action>
	</Actions> </Target>
		<Condition>
			<VariableReference VariableId="is-creator"/>	
		</Condition>
	</Rule>
	
	<Rule RuleId="update-rule" Effect="Permit">
	<Description>
		For all row-update operations:
		Allow operation only by creator (if subject-name equals name column)
		and if name column is not being updated.
	</Description>
	<Target> <Actions> <Action> <ActionMatch MatchId="equal">
		<AttributeValue DataType="string">row-update</AttributeValue>
		<ActionAttributeDesignator AttributeId="action-id"/>
	</ActionMatch></Action> </Actions> </Target>
	<Condition>
	<Apply FunctionId="and">
			<VariableReference VariableId="is-creator"/>
			<Apply FunctionId="not">
				<Apply FunctionId="is-in">
					<AttributeValue DataType="string">db.cat.sch.tab.name</AttributeValue>
					<ResourceAttributeDesignator AttributeId="column-name"/>
				</Apply>
			</Apply>
	</Apply>
	</Condition>
	</Rule>
	
</Policy>
