// these policies need to be set with the provider app id and correct resource names to work.
// also I don't know what the Sid field does, I think it was autogenerated by aws.
// the * at the end of the resounce names allows the table and all of it's indices to be accessed by this permission

module.exports = {

   fbListTables: {
	"Version": "2012-10-17",
	"Statement": [
	    {
		"Sid": "Stmt1392737713000",
		"Effect": "Allow",
		"Action": [
		    "dynamodb:ListTables"
		],
		"Resource": [
		    "*"
		]
	    }
	]
    },

    fbpublic: {
	"Version": "2012-10-17",
	"Statement": [
	    {
		"Sid": "Stmt1392733263000",
		"Effect": "Allow",
		"Action": [
		    "dynamodb:BatchGetItem",
		    "dynamodb:DescribeTable",
		    "dynamodb:GetItem",
		    "dynamodb:ListTables",
		    "dynamodb:Query",
		    "dynamodb:Scan"
		],
		"Resource":"arn:aws:dynamodb:us-west-2:735148112467:table/docs*"
	    }
	]
    },

    fbprivate: {
	"Version": "2012-10-17",
	"Statement": [
	    {
		"Action": [
		    "dynamodb:*"
		],
		"Effect": "Allow",
		"Resource": "arn:aws:dynamodb:us-west-2:735148112467:table/*",
		"Condition": {
                    "ForAllValues:StringEquals": {
			"dynamodb:LeadingKeys":  ["fb||${graph.facebook.com:id}"] // this won't work for indices where the owner isn't the key
                    }
		}
	    }
	]
    }


    ggListTables: {
	"Version": "2012-10-17",
	"Statement": [
	    {
		"Sid": "Stmt1392737733000",
		"Effect": "Allow",
		"Action": [
		    "dynamodb:ListTables"
		],
		"Resource": [
		    "*"
		]
	    }
	]
    },

    ggpublic: {
	"Version": "2012-10-17",
	"Statement": [
	    {
		"Sid": "Stmt1392733263000",
		"Effect": "Allow",
		"Action": [
		    "dynamodb:BatchGetItem",
		    "dynamodb:DescribeTable",
		    "dynamodb:GetItem",
		    "dynamodb:ListTables",
		    "dynamodb:Query",
		    "dynamodb:Scan"
		],
		"Resource":"arn:aws:dynamodb:us-west-2:735148112467:table/docs*"
	    }
	]
    },

    ggprivate: {
	"Version": "2012-10-17",
	"Statement": [
	    {
		"Action": [
		    "dynamodb:*"
		],
		"Effect": "Allow",
		"Resource": "arn:aws:dynamodb:us-west-2:735148112467:table/*",
		"Condition": {
                    "ForAllValues:StringEquals": {
			"dynamodb:LeadingKeys":  ["google||${accounts.google.com:sub}"],
			"dynamodb:Attributes": [
			    "owner","docId","author","docType","topic"
			]
                    },
                    "StringEqualsIfExists": {"dynamodb:owner": "google||${accounts.google.com:sub}"}
		}
	    }
	]
    }
};

// obviously, if you want to grant access through AWS login, you'll need another set of these
// also if you want to grant access to the resources from other AWS things, I haven't done that yet, so chill your balls