[request_definition]
r = sub, obj, act
r2 = sub, obj, act
r3 = sub, obj, act

[policy_definition]
p = sub, obj, act
p2 = sub_rule, obj, act, eft
p3 = sub, obj, act, eft

[role_definition]
g = _, _

# https://casbin.org/docs/syntax-for-models#policy-effect
# Do not use 'p2' to replace 'p'. This is hardcode. :(
[policy_effect]
e = some(where (p.eft == allow))
e2 = some(where (p.eft == allow))
e3 = subjectPriority(p.eft) || deny

[matchers]
# RABC
m = artus_inject_pre_and(r.sub, p.sub) && g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act || artus_inject_suf_or(r.sub, p.sub)
m3 = artus_inject_pre_and(r3.sub, p3.sub) && g(r3.sub, p3.sub) && eval(p3.sub_rule) && r3.obj == p3.obj && r3.act == p3.act || artus_inject_suf_or(r3.sub, p3.sub)
# ABAC
m2 = artus_inject_pre_and(r2.sub, p2.sub) && eval(p2.sub_rule) && r2.obj == p2.obj && r2.act == p2.act || artus_inject_suf_or(r2.sub, p2.sub)