SYSTEM max_system;
------------------------------------------
-----CONDITION ATTRIBUTE BLOCK------------
CONDITION_ATTRIBUTE current_user_profile.dynamicFields.FREE_IPA.mobile TYPE simple DYNAMIC;
------------------------------------------
----------RESOURCE BLOCK------------------
RESOURCE_TYPE user_type          RESOURCES user         ACTIONS read;
RESOURCE_TYPE user_info_type     RESOURCES user_info    ACTIONS read;
RESOURCE_TYPE user_list_type     RESOURCES user_list    ACTIONS read;
------------------------------------------
----------CONDITIONAL BLOCK---------------
CONDITION full_access       VALUE true;
CONDITION by_phone          VALUE '+7-999-999-999-999'.equals(current_user_profile.dynamicFields.FREE_IPA.mobile);
------------------------------------------
---------------POLICY BLOCK---------------
POLICY user_list__read__full_access             RESOURCE_TYPE user_list_type   RESOURCE user_list         ACTION    read    CONDITION full_access;
POLICY user_info_type__read__by_phone           RESOURCE_TYPE user_info_type   RESOURCE user_info    ACTION    read    CONDITION by_phone;
POLICY user__read__full_access                  RESOURCE_TYPE user_type        RESOURCE user         ACTION    read    CONDITION full_access;
------------------------------------------
----------------ROLE ATTRIBUTE BLOCK--------
ROLE_ATTRIBUTE head;
------------------------------------------
----------------ROLE BLOCK----------------
ROLE admin
  LABEL Админ
  ENABLED
  ATTRIBUTE head VALUE systems;
ROLE user
  LABEL Пользователь
  ENABLED;
------------------------------------------
--------ROLE POLICY RELATION BLOCK--------
ACCESS_RULE admin
    POLICY
        user_list__read__full_access
        user__read__full_access;
ACCESS_RULE user
    POLICY
        user_list__read__full_access
        user_info_type__read__by_phone;
-------------------------------------------

