<?xml version="1.0" encoding="UTF-8"?>
<PolicySet PolicyCombiningAlgId="urn:oasis:names:tc:xacml:1.0:policy-combining-algorithm:permit-overrides" PolicySetId="urn:elga:bes:2019:1.2.40.0.34.3.9.114.8.1" xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="urn:oasis:names:tc:xacml:2.0:policy:schema:os http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-policy-schema-os.xsd">
    <Description>The general request policy for time based access for the GDA</Description>
    <Target/>

    <Policy PolicyId="urn:elga:bes:2019:1.2.40.0.34.3.9.114.8.1.1" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os">
        <Description>Policy that denies if no permit role did match</Description>
        <Target/>

        <Rule RuleId="urn:elga:bes:2019:1.2.40.0.34.3.9.114.8.1.1.2.1" Effect="Permit"> <!-- permit reads if no contact is needed for e-Impfpass:read:noContact -->
            <Target>
                <Resources>
                    <Resource>
                        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
                            <ResourceAttributeDesignator AttributeId="urn:elga:bes:2019:transaction.action" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                        </ResourceMatch>
                    </Resource>
                </Resources>
            </Target>
            <Condition>
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:elga:bes:2019:permission:e-Impfpass:read:noContact</AttributeValue>
                    </Apply>
                    <SubjectAttributeDesignator AttributeId="urn:elga:bes:permission" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                </Apply>
            </Condition>
        </Rule>

        <Rule Effect="Deny" RuleId="urn:elga:bes:2019:1.2.40.0.34.3.9.114.8.1.1.2.2"/>

        <Obligations>
            <Obligation FulfillOn="Deny" ObligationId="obligation_DENY_read_no_contact"/>
            <Obligation FulfillOn="Permit" ObligationId="obligation_PERMIT_read_no_contact"/>
        </Obligations>


    </Policy>

    <Policy PolicyId="urn:elga:bes:2019:1.2.40.0.34.3.9.114.8.1.2" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os">
        <Target/>
        <Rule RuleId="urn:elga:bes:2019:1.2.40.0.34.3.9.114.8.1.2.2.1" Effect="Permit"> <!-- permit reads with contact in the last 28 Days for e-Impfpass:read:contact -->
            <Target>
                <Resources>
                    <Resource>
                        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
                            <ResourceAttributeDesignator AttributeId="urn:elga:bes:2019:transaction.action" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                        </ResourceMatch>
                    </Resource>
                </Resources>
            </Target>
            <Condition>
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:double-less-than-or-equal">
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:double-one-and-only">
                            <EnvironmentAttributeDesignator AttributeId="urn:elga:bes:2013:kbs" DataType="http://www.w3.org/2001/XMLSchema#double"/>
                        </Apply>
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#double">2419200</AttributeValue> <!-- value in seconds - 28 days -->
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:elga:bes:2019:permission:e-Impfpass:read:contact</AttributeValue>
                        </Apply>
                        <SubjectAttributeDesignator AttributeId="urn:elga:bes:permission" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                    </Apply>
                </Apply>
            </Condition>
        </Rule>

        <Rule RuleId="urn:elga:bes:2019:1.2.40.0.34.3.9.114.8.1.2.2.2" Effect="Deny"/>

        <Obligations>
            <Obligation FulfillOn="Deny" ObligationId="obligation_DENY_read_contact"/>
            <Obligation FulfillOn="Permit" ObligationId="obligation_PERMIT_read_contact"/>
        </Obligations>

    </Policy>


    <Policy PolicyId="urn:elga:bes:2019:1.2.40.0.34.3.9.114.8.1.3" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os">
        <Target/>
        <Rule RuleId="urn:elga:bes:2019:1.2.40.0.34.3.9.114.8.1.3.2.1" Effect="Permit">  <!-- permit write with contact in the last 28 Days for e-Impfpass:write:contact -->
            <Target>
                <Resources>
                    <Resource>
                        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">write</AttributeValue>
                            <ResourceAttributeDesignator AttributeId="urn:elga:bes:2019:transaction.action" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                        </ResourceMatch>
                    </Resource>
                </Resources>
            </Target>
            <Condition>
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:double-less-than-or-equal">
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:double-one-and-only">
                            <EnvironmentAttributeDesignator AttributeId="urn:elga:bes:2013:kbs" DataType="http://www.w3.org/2001/XMLSchema#double"/>
                        </Apply>
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#double">2419200</AttributeValue> <!-- value in seconds - 28 days -->
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:elga:bes:2019:permission:e-Impfpass:write:contact</AttributeValue>
                        </Apply>
                        <SubjectAttributeDesignator AttributeId="urn:elga:bes:permission" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                    </Apply>
                </Apply>
            </Condition>
        </Rule>

        <Rule RuleId="urn:elga:bes:2019:1.2.40.0.34.3.9.114.8.1.3.2.2" Effect="Deny"/>

        <Obligations>
            <Obligation FulfillOn="Deny" ObligationId="obligation_DENY_write_contact"/>
            <Obligation FulfillOn="Permit" ObligationId="obligation_PERMIT_write_contact"/>
        </Obligations>

    </Policy>


    <Policy PolicyId="urn:elga:bes:2019:1.2.40.0.34.3.9.114.8.1.4" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os">
        <Target/>
        <Rule RuleId="urn:elga:bes:2019:1.2.40.0.34.3.9.114.8.1.4.2.1" Effect="Permit">  <!-- permit update with contact in the last 28 Days for e-Impfpass:write:contact AND e-Impfpass:update:contact -->
            <Target>
                <Resources>
                    <Resource>
                        <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">update</AttributeValue>
                            <ResourceAttributeDesignator AttributeId="urn:elga:bes:2019:transaction.action" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                        </ResourceMatch>
                    </Resource>
                </Resources>
            </Target>
            <Condition>
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:double-less-than-or-equal">
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:double-one-and-only">
                            <EnvironmentAttributeDesignator AttributeId="urn:elga:bes:2013:kbs" DataType="http://www.w3.org/2001/XMLSchema#double"/>
                        </Apply>
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#double">2419200</AttributeValue> <!-- value in seconds - 28 days -->
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
                        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:elga:bes:2019:permission:e-Impfpass:write:contact</AttributeValue>
                            <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">urn:elga:bes:2019:permission:e-Impfpass:update:contact</AttributeValue>
                        </Apply>
                        <SubjectAttributeDesignator AttributeId="urn:elga:bes:permission" DataType="http://www.w3.org/2001/XMLSchema#string"/>
                    </Apply>
                </Apply>
            </Condition>
        </Rule>

        <Rule RuleId="urn:elga:bes:2019:1.2.40.0.34.3.9.114.8.1.4.2.2" Effect="Deny"/>

        <Obligations>
            <Obligation FulfillOn="Deny" ObligationId="obligation_DENY_update_contact"/>
            <Obligation FulfillOn="Permit" ObligationId="obligation_PERMIT_update_contact"/>
        </Obligations>

    </Policy>

</PolicySet>
