Skip to main content
The Sylo Data Permissions allows data authors to grant, update, and revoke data permissions. It integrates with the Sylo Data Verification pallet to allow authors to manage fine-grained access control over their data.

Permission Levels

There are three types of permissions that can be associated with data items:
  • VIEW: Allows the grantee to view the data when fetching the item from a storage sylo.
  • MODIFY: Allows the grantee to modify the data. This includes the onchain validation record and also the data itself that is held by storage sylos.
  • DISTRIBUTE: Allows the grantee to distribute the data.
The MODIFY and DISTRIBUTE permissions imply the VIEW permission.

Record Types

Data permissions are stored as records in the Sylo Data Permissions pallet. There are three differing forms of records to satisfy various use cases:
  • Data Permission Record: This is the simplest form of record and applies to a single data item.
  • Tagged Permission Record: A tagged record will hold a set of data tags. The permission applies to any data items that share at least of the tags in the record. This allows an author to easily grant a permission to a group of related data items.
  • Permission Reference Record: This record type indicates that there exists another permission record that is stored offchain on a storage sylo. The offchain permission record itself requires that a on-chain validation record for it exists and stores the actual permissions. This type of record is suitable when an author whishes to grant permissions over many data items that may not share any tags.

Calls

grantDataPermissions

Grants another account access permissions for a set of data items. The caller must be the author or have been granted the DISTRIBUTE permission by the author. Namespace
Type
Data permission records are stored as a list of record under the key of (grantor, grantee). A u32 value will be assigned to each record to identify it.

revokeDataPermission

Revokes a previously granted data permission. The caller must be the author or the original grantor of the permission. Namespace
Type

grantTaggedPermissions

Grants a tagged permission record. The caller must be the original data author. Distributors are not allowed to grant tagged permissions. Namespace
Type

revokeTaggedPermission

Revokes a previously granted tagged permission. The caller must be the author or the original grantor of the permission. Namespace
Type

grantPermissionReference

Creates a permission reference record. The caller must be the author. Namespace
Type

revokePermissionReference

Revokes a previously granted permission reference. The caller must be the author. Namespace
Type

Storage

PermissionRecords

Maps from grantor and grantee to a permission record id and the permission record itself. Namespace
Type

TaggedPermissionRecords

Maps from grantor and grantee to a permission record id and the tagged permission record. Namespace
Type

PermissionReferences

Stores permission references for off-chain records. Namespace
Type

Events

DataPermissionGranted

An account has been granted permission for a specific data record. Namespace
Type

DataPermissionRevoked

An account’s permission has been revoked for a specific data record. Namespace
Type

ExpiredDataPermissionRemoved

An expired data permission has been automatically removed. Namespace
Type

TaggedDataPermissionsGranted

An account has been granted tagged permissions. Namespace
Type

TaggedDataPermissionsRevoked

A tagged permission for an account has been revoked. Namespace
Type

PermissionReferenceGranted

An account has been granted a permission reference. Namespace
Type

PermissionReferenceRevoked

An account’s permission reference has been revoked. Namespace
Type

Errors

DataRecordDoesNotExist

Attempted to grant permissions for a data record that does not exist. Namespace

IrrevocableCannotBeExpirable

A permission that is set to irrevocable cannot also be set to have an expiry. Namespace

InvalidExpiry

Expiry value for permission record is invalid. Namespace

ExceededMaxPermissions

Exceeded the maximum number of record permissions granted to a given account. Namespace

MissingDistributePermission

Attempted to grant a permission as a delegate without the required DISTRIBUTE permission. Namespace

CannotGrantDistributePermission

Distribute permissions can only be granted by the data author. Namespace

PermissionIrrevocable

An irrevocable permission cannot be revoked. Namespace

NotPermissionGrantor

Only the account that granted a permission or the data author can revoke a permission. Namespace

PermissionNotFound

Cannot revoke a permission that does not exist. Namespace

MissingValidationRecord

An accompanying verification record for the off-chain permission does not exist. Namespace

PermissionReferenceAlreadyExists

An existing permission reference has already been granted. Namespace

ExceededMaxExpiringPermissions

Exceeded the maximum number of permissions that can expire on the same block. Namespace

InvalidString

String values in an RPC call, in either the inputs or outputs, are invalid. Namespace