SYSTEM for_test_containers CONTAINER test_container;
----------RESOURCE BLOCK------------------
RESOURCE_TYPE ordr_cards_type
    RESOURCES
        ordr_cards
    ACTIONS;
RESOURCE_TYPE user_card_type
    RESOURCES
        user_card
        user_card_2
        user_card_3
    ACTIONS;
RESOURCE_TYPE user_cert_type
    RESOURCES
        user_cert
    ACTIONS;
RESOURCE_TYPE user_password_via_order
    RESOURCES
        user_password_via_order
    ACTIONS;
-------------------------------------------
-------------CONDITIONAL BLOCK-------------
CONDITION true_condition                                                         VALUE true;
-------------------------------------------
---------------POLICY BLOCK----------------
POLICY read_own_orders
RESOURCE_TYPE ordr_cards_type
    RESOURCE ordr_cards           ACTION read;
POLICY read_own_orders_all
RESOURCE_TYPE user_card_type
    RESOURCE *                    ACTION write;
POLICY read_own_orders_multiple
RESOURCE_TYPE user_card_type
    RESOURCE user_card            ACTION read
    RESOURCE user_card_2          ACTION read;
POLICY change_own_cert
RESOURCE_TYPE user_cert_type
    RESOURCE user_cert            ACTION create delete
CONDITION true_condition;
POLICY update_own_password
RESOURCE_TYPE user_password_via_order
    RESOURCE user_password_via_order ACTION update
CONDITION true_condition;
-------------------------------------------
--------------ROLE_ATTRIBUTE---------------
ROLE_ATTRIBUTE color;
ROLE_ATTRIBUTE weight;
-------------------------------------------
----------------ROLE BLOCK-----------------
ROLE manager_in_container
    LABEL Менеджер
    ENABLED
    NEED_CONTROLLED_INFO_SYSTEM
    PRIVILEGED
    ATTRIBUTE color                           VALUE black
    ATTRIBUTE weight                          VALUE 200 + 5;
ROLE user_in_container
    LABEL Пользователь
    ENABLED
    CONDITION true_condition;
-------------------------------------------
-------------ROLE GROUP BLOCK--------------
ROLE_GROUP user_group
    LABEL Группа пользовательских ролей
    ROLES
        user_in_container;
ROLE_GROUP superuser_group
    LABEL Группа ролей
    ROLES
        manager_in_container
        user_in_container;
-------------------------------------------
----------ROLE COMBINATION BLOCK-----------
ROLE_COMBINATION user_in_container
    ROLE_COMBININGS
        manager_in_container;
-------------------------------------------
---------ROLE POLICY RELATION BLOCK--------
ACCESS_RULE manager_in_container
    POLICY
        read_own_orders
        read_own_orders_all
;
ACCESS_RULE user_in_container
    POLICY
        change_own_cert
        read_own_orders_multiple
        update_own_password
;