Hyperledger transaction Permission to participant based on some 3rd resource - hyperledger-fabric

Question

I was working on some permission logic for Hyperledger , When need arise for a condition where i need to use 3 resources in permission.acl condition.
To Brief about scenario Let us suppose Resource Transaction is t for which Read Permission needs to be given, Participant is P Who needs to read transaction t.
Now Transaction t contains an identifier name for Asset A .
So I want to make a condition like if Asset A where Identifier(name) is equal to to the transaction T name , compares the Asset A registrar(This will hold participant name) with the Participant P Identifier. And If comparison is successful then give read permission of Resource(Transaction T) to Participant P.
Eg Snippet.
Asset ABC identified by name{
o String name;
--> Company registrar; (Company is type of participant)
}
Transaction CreateABC{
o String name;
}
So Participant P of type company should have permission to Read Transaction CreateABC if the Asset containing createABC.name has registar equal to P.getIdenitifer();
I have read that We can create separate functions in js file and call that from permission.acl but i am not yet able to fulfill this scenario.

Answer 1

An example of using 3 resources would be something like (example):
// first, access to invoke the transaction resource itself
rule Transaction_access {
description: "Can generate transaction"
participant: "org.acme.account.AccountTrader"
operation: CREATE
resource: "org.acme.account.TransferAmount"
action: ALLOW
}
// next, the (example) dynamic ACL rule that evaluates between who the transaction is being done
rule BiTrade_betweenTraders_only {
description: "Only Allow Updatee between Transferor/Transferee via named transaction"
participant(p): "org.acme.account.AccountTrader"
operation: ALL
resource(v): "org.acme.account.BankAccount"
transaction(tx): "org.acme.account.TransferAmount"
condition: ( p.getIdentifier() === v.owner.getIdentifier() && v.getIdentifier() === tx.targetAccount.getIdentifier() )
action: ALLOW
}
UPDATED with item 2:
An example of giving access to a transaction resource, based on an Asset ownership by a participant (both derived from the transaction object) might be:
rule my_restricted_Transaction_access {
description: "as per description above"
participant(p): "org.acme.account.AccountTrader"
operation: CREATE
resource(v): "org.acme.account.TransferAmount"
condition: ( p.getIdentifier() === v.account.owner.getIdentifier() )
action: ALLOW
}
where TransferAmount might be defined as:
transaction TransferAmount {
--> Account account // asset
}
and account has an --> owner field pointing back to AccountTrader ( the participant, in my original example - etc etc) - bear in mind, your ACLs would have to allow the participant to have access to the relevant asset and asset owner target resource too.
obviously this is a simple example - but you can define your function (to do the equivalent check, for your model) in the condition section. If you've added the JS script to your BNA under /lib (and upgraded the business network on Fabric to take effect) - you then just have to worry about whether your function name is what you called it (again, the links I sent you should provide a clear example of it in use).
Calling a function as part of your ACL condition is straightforward - you can see an example of this in this github test file -> the function (JS) is here https://github.com/hyperledger/composer/blob/master/packages/composer-tests-functional/systest/data/accesscontrols.js#L23 and the corresponding (calling) ACL ruleset is here -> https://github.com/hyperledger/composer/blob/master/packages/composer-tests-functional/systest/data/accesscontrols.acl#L124
UPDATED item 3:
eg in your permissions.acl file a rule like:
rule rule_func_condition {
description: "Allow all participants access to all resources"
participant(p): "org.acme.account.AccountTrader"
operation: CREATE
resource(a): "org.example.account.TransferAmount"
condition: (testOwnership(a, p))
action: ALLOW
}
in your functions.js (or whatever) in the /lib folder (or you can have it your existing logic.js if you prefer, however you want to do it):
/**
* Test that the specified asset is owned by the specified participant.
* #param {Resource} asset The asset.
* #param {Resource} participant The participant.
* #return {boolean} True if yes, false if no.
*/
function testOwnership(asset, participant) {
return asset.owner.getIdentifier() === participant.getIdentifier();
}
where asset and participant objects are passed into this particular function example.