auditing-fig8.conf

roles {
  role user
    comment "Regular user.";
  role admin
    comment "Super-user.";
};

struct company {
  field name text;
  field id int rowid;
};

struct user {
  comment "A regular user.";
  field company struct companyid;
  field hash password limit gt 0 
    comment
      "Password hash.
       This is passed to inserts and updates as a password,
       then hashed within the implementation and extracted
       (in listings and searches) as the hash value.";
  field email email unique
    comment "Unique e-mail address.";
  field companyid:company.id;
  field name text
    comment "User's full name.";
  field uid int rowid;
  search email,hash: name creds 
    comment
      "Search for a unique user with their e-mail and
       password.
       This is a quick way to verify that a user has entered
       the correct password for logging in.";
  search uid: name uid
    comment "Lookup by unique identifier.";
  update hash: uid: name hash
    comment "User updating their password.";
  update email: uid: name email
    comment "User updating unique e-mail.";
  insert;
  roles user {
    search uid;
    update hash;
    update email;
    noexport uid;
  };
  roles admin {
    insert;
  };
  roles default {
    search creds;
  };
};

struct session { 
  comment "Authenticated session.";
  field user struct userid;
  field userid:user.uid int 
    comment "Associated user.";
  field token int 
    comment "Random cookie.";
  field mtime epoch;
  field id int rowid;
  search id, token: name creds
    comment "Search for logged-in users.";
  iterate: distinct user.company name companies;
  insert;
  delete id: name id 
    comment "Delete by identifier.";
  roles user {
    insert;
    delete id;
  };
  roles default {
    search creds;
    iterate companies;
  };
};