diff --git a/docs/sample-inventory-management/tailordb_gql_permission_product.tf b/docs/sample-inventory-management/tailordb_gql_permission_product.tf new file mode 100644 index 0000000..e8c3f4b --- /dev/null +++ b/docs/sample-inventory-management/tailordb_gql_permission_product.tf @@ -0,0 +1,24 @@ +resource "tailor_tailordb_gql_permission" "product" { + workspace_id = tailor_workspace.ims.id + namespace = tailor_tailordb.ims.namespace + type = tailor_tailordb_type.product.name + + policies = [ + { + conditions = [ + { left = { user = "role" }, operator = "eq", right = { value = { string = "ADMIN" } } } + ] + actions = ["all"] + permit = "allow" + description = "Administrators have full access to all GraphQL operations" + }, + { + conditions = [ + { left = { user = "_loggedIn" }, operator = "eq", right = { value = { boolean = true } } } + ] + actions = ["create", "read", "update"] + permit = "allow" + description = "Authenticated users can create, read, and update tasks" + }, + ] +} \ No newline at end of file diff --git a/docs/sample-inventory-management/tailordb_product.tf b/docs/sample-inventory-management/tailordb_product.tf index 51aa934..eabbf0e 100644 --- a/docs/sample-inventory-management/tailordb_product.tf +++ b/docs/sample-inventory-management/tailordb_product.tf @@ -67,5 +67,42 @@ resource "tailor_tailordb_type" "product" { } } - type_permission = local.permission_everyone + permission = { + create = [ + { + conditions = [ + { left = { user = "role" }, operator = "eq", right = { value = { string = "ADMIN" } } } + ] + permit = "allow" + description = "Administrators can create any task" + }, + ] + read = [ + { + conditions = [ + { left = { user = "role" }, operator = "eq", right = { value = { string = "ADMIN" } } } + ] + permit = "allow" + description = "Administrators can read all tasks" + }, + ] + update = [ + { + conditions = [ + { left = { user = "role" }, operator = "eq", right = { value = { string = "ADMIN" } } } + ] + permit = "allow" + description = "Administrators can update any task" + }, + ] + delete = [ + { + conditions = [ + { left = { user = "role" }, operator = "eq", right = { value = { string = "ADMIN" } } } + ] + permit = "allow" + description = "Administrators can delete any task" + } + ] + } }