---
AccessControlRight:
  tableName: accesscontrol_rights
  columns:
    name: &RIGHT_NAME
      type: string(32)
      notnull: true
      primary: true
    description: string
  indexes:
    index_name:
      fields: [name]

AccessControlPrincipal:
  tableName: accesscontrol_principals
  columns:
    principal_id: &IDREF
      type: integer
      unsigned: true
      notnull: true
    principal_type: &PRINCIPAL_TYPE
      type: enum
      values: [user, group]
      notnull: true
    lft: *IDREF
    rgt: *IDREF
    level: *IDREF
  indexes:
    index_lft:
      fields: [lft]
    index_rgt:
      fields: [rgt]
    index_lft_rgt:
      fields: [lft, rgt]
    index_level:
      fields: [level]
    index_lft_rgt_level:
      fields: [lft, rgt, level]
    index_principal:
      fields: [principal_id, principal_type]

AccessControlRightEntry:
  tableName: accesscontrol_right_entries
  columns:
    principal_id: *IDREF
    principal_type: *PRINCIPAL_TYPE
    node_id: *IDREF
    right_name: &RIGHT_REF
      type: string(32)
      notnull: true
    allow:
      type: boolean
      notnull: true
  indexes:
    index_principal:
      fields: [principal_id, principal_type]
    index_principal_node:
      fields: [principal_id, principal_type, node_id]
    index_principal_node_right:
      fields: [principal_id, principal_type, node_id, right_name]
      type: unique
  relations:
    Node:
      local: node_id
      foreignAlias: RightEntries
      onUpdate: cascade
      onDelete: cascade
    AccessControlRight:
      local: right_name
      foreign: name
      alias: Right
      foreignAlias: Entries
      onUpdate: cascade
      onDelete: cascade

AccessControlResource:
  tableName: accesscontrol_resources
  columns:
    name: *RIGHT_NAME
    description: string

AccessControlPrivilege:
  tableName: accesscontrol_privileges
  columns:
    name: *RIGHT_NAME
    description: string

AccessControlResourcePrivilege:
  tableName: accesscontrol_resource_privileges
  columns:
    resource: *RIGHT_NAME
    privilege: *RIGHT_NAME
  relations:
    AccessControlResource:
      foreignAlias: ResourcePrivileges
      alias: Resource
      local: resource
      foreign: name
      onUpdate: cascade
      onDelete: cascade
    AccessControlPrivilege:
      foreignAlias: ResourcePrivileges
      alias: Privilege
      local: privilege
      foreign: name
      onUpdate: cascade
      onDelete: cascade

AccessControlPrivilegeEntry:
  tableName: accesscontrol_privilege_entries
  columns:
    principal_id: *IDREF
    principal_type: *PRINCIPAL_TYPE
    resource: *RIGHT_REF
    privilege: *RIGHT_REF
    allow:
      type: boolean
      notnull: true
  indexes:
    index_principal:
      fields: [principal_id, principal_type]
    index_principal_resource:
      fields: [principal_id, principal_type, resource]
    index_principal_resource_privilege:
      fields: [principal_id, principal_type, resource, privilege]
      type: unique
  relations:
    AccessControlResource:
      local: resource
      foreign: name
      alias: Resource
      foreignAlias: PrivilegeEntries
      onUpdate: cascade
      onDelete: cascade
    AccessControlPrivilege:
      local: privilege
      foreign: name
      alias: Privilege
      foreignAlias: Entries
      onUpdate: cascade
      onDelete: cascade
