@inflightit/api-plugin-orders/src/policies.json

Orders plugin for the Reaction API

[
  {
    "description": "Order managers acting on all entities.",
    "subjects": [ "reaction:groups:order-managers" ],
    "resources": [ "reaction:legacy:orders" ],
    "actions": [ "read" ],
    "effect": "allow"
  },
  {
    "description": "Order managers acting on specific entities.",
    "subjects": [ "reaction:groups:order-managers" ],
    "resources": [ "reaction:legacy:orders:*" ],
    "actions": [
      "approve:payment",
      "cancel:item",
      "capture:payment",
      "move:item",
      "refund:payment",
      "update"
    ],
    "effect": "allow"
  },
  {
    "description": "Order owner acting on their order.",
    "subjects": [ "reaction:users:*" ],
    "resources": [ "reaction:legacy:orders:*" ],
    "actions": [
      "cancel:item",
      "cancel:order",
      "read",
      "update"
    ],
    "effect": "allow",
    "conditions": {
      "owner": {
        "type": "EqualsSubjectCondition",
        "options": {}
      }
    }
  }
]