<?xml version="1.0"?>
<component name="org.nuxeo.ecm.core.security.defaultPermissions.override">

  <require>org.nuxeo.ecm.core.security.defaultPermissions</require>

  <documentation>


    Default permissions (atomic and compound) used by the core. If you
    edit this file, please update the specification file:
    doc/NXCore-Security.txt in core module

    @author <a href="mailto:og@nuxeo.com">Olivier Grisel</a>

  </documentation>
  <extension point="permissions" target="org.nuxeo.ecm.core.security.SecurityService">

    <permission name="Browse"/>
    <permission name="ReadProperties">
      <include>Browse</include>
    </permission>
    <permission name="ReadChildren"/>
    <permission name="ReadLifeCycle"/>
    <permission name="ReviewParticipant"/>
    <permission name="ReadSecurity"/>

    <permission name="WriteProperties"/>
    <permission name="ReadVersion"/>

    <permission name="WriteVersion">
       <include>WriteProperties</include>
    </permission>

    <permission name="Version">
       <include>ReadVersion</include>
       <include>WriteVersion</include>
    </permission>

    <permission name="Read">
      <include>Browse</include>
      <include>ReadVersion</include>
      <include>ReadProperties</include>
      <include>ReadChildren</include>
      <include>ReadLifeCycle</include>
      <include>ReadSecurity</include>
      <include>ReviewParticipant</include>
    </permission>

    <permission name="AddChildren"/>
    <permission name="RemoveChildren"/>
    <permission name="Remove"/>
    <permission name="ManageWorkflows"/>
    <permission name="WriteLifeCycle"/>
    <permission name="Unlock"/>

    <permission name="Remove">
      <documentation>
        NXP-10929: necessary to follow the "delete" transition when Trash is enabled: include WriteLifeCycle
      </documentation>
      <include>RemoveChildren</include>
      <include>WriteLifeCycle</include>
    </permission>

    <permission name="ReadRemove">
      <include>Read</include>
      <include>Remove</include>
    </permission>

    <permission name="Write">
      <include>AddChildren</include>
      <include>WriteProperties</include>
      <include>Remove</include>
      <include>ManageWorkflows</include>
      <include>WriteLifeCycle</include>
      <include>WriteVersion</include>
    </permission>

    <permission name="ReadWrite">
      <include>Read</include>
      <include>Write</include>
    </permission>

    <permission name="WriteSecurity"/>

    <permission name="Everything">
      <documentation>
        Special permission given to administrators: god-level access
      </documentation>
    </permission>

    <permission name="RestrictedRead">
      <documentation>
        Deprecated - was used only for a single customer project before pluggable permission definitions
      </documentation>
    </permission>

    <permission name="MakeRecord"/>
    <permission name="SetRetention"/>
    <permission name="ManageLegalHold"/>
    <!-- Only for flexible records -->
    <permission name="UnsetRetention"/>

    <permission name="WriteColdStorage"/>

  </extension>

</component>
