The Sylo Data Permissions allows data authors to grant, update, and revoke data permissions. It integrates with the Sylo Data Verification pallet to allow authors to manage fine-grained access control over their data.

​
Permission Levels

There are three types of permissions that can be associated with data items:
  • VIEW: Allows the grantee to view the data when fetching the item from a storage sylo.
  • MODIFY: Allows the grantee to modify the data. This includes the onchain validation record and also the data itself that is held by storage sylos.
  • DISTRIBUTE: Allows the grantee to distribute the data.
The MODIFY and DISTRIBUTE permissions imply the VIEW permission. 
enum DataPermission {
	VIEW,
	MODIFY,
	DISTRIBUTE,
}

​
Record Types

Data permissions are stored as records in the Sylo Data Permissions pallet. There are three differing forms of records to satisfy various use cases:
  • Data Permission Record: This is the simplest form of record and applies to a single data item.
  • Tagged Permission Record: A tagged record will hold a set of data tags. The permission applies to any data items that share at least of the tags in the record. This allows an author to easily grant a permission to a group of related data items.
  • Permission Reference Record: This record type indicates that there exists another permission record that is stored offchain on a storage sylo. The offchain permission record itself requires that a on-chain validation record for it exists and stores the actual permissions. This type of record is suitable when an author whishes to grant permissions over many data items that may not share any tags.

​
Calls

​
grantDataPermissions

Grants another account access permissions for a set of data items. The caller must be the author or have been granted the DISTRIBUTE permission by the author. Namespace 
api.tx.syloDataPermissions.grantDataPermissions
Type 
function grantDataPermissions(
  /// The account that owns the data. When this differs from the caller, the caller
  /// must be a distributor.
  data_author: AccountId,

  /// The account to grant permissions to
  grantee: AccountId,

  /// List of data ids
  data_ids: Vec<Vec<Bytes>>,

  /// The permission level
  permission: DataPermission,

  /// An optional blocknumber for the expiry
  expiry: Option<BlockNumber>,

  /// Whether the permission is irrevocable
  irrevocable: bool,
)
Data permission records are stored as a list of record under the key of (grantor, grantee). A u32 value will be assigned to each record to identify it.

​
revokeDataPermission

Revokes a previously granted data permission. The caller must be the author or the original grantor of the permission. Namespace 
api.tx.syloDataPermissions.revokeDataPermission
Type 
function revokeDataPermission(
  /// The account that owns the data. When this differs from the caller, the caller
  /// must be a distributor.
  data_author: AccountId,

  /// The id of the permission record.
  permission_id: u32,

  /// The account that was granted the permission
  grantee: AccountId,

  /// The data id of the item to revoke the permission for
  data_id: Vec<Vec<Bytes>>,
)

​
grantTaggedPermissions

Grants a tagged permission record. The caller must be the original data author. Distributors are not allowed to grant tagged permissions. Namespace 
api.tx.syloDataPermissions.grantTaggedPermissions
Type 
function grantTaggedPermissions(
  /// The account that was granted the permission
  grantee: AccountId,

  /// The permission level
  permission: DataPermission,

  /// List of data tags
  tags: Vec<Vec<Bytes>>,

  /// An optional blocknumber for the expiry
  expiry: Option<BlockNumber>,

  /// Whether the permission is irrevocable
  irrevocable: bool,
)

​
revokeTaggedPermission

Revokes a previously granted tagged permission. The caller must be the author or the original grantor of the permission. Namespace 
api.tx.syloDataPermissions.revokeTaggedPermission
Type 
function revokeTaggedPermission(
  /// The id of the permission record.
  permission_id: u32,

  /// The account that was granted the permission
  grantee: AccountId,
)

​
grantPermissionReference

Creates a permission reference record. The caller must be the author. Namespace 
api.tx.syloDataPermissions.grantPermissionReference
Type 
function grantPermissionReference(
  /// The account to grant permissions to
  grantee: AccountId,

  /// The data id of the offchain permission record. This data item
  // must have an accompanying on-chain validation record.
  permission_record_id: Vec<Bytes>,
)

​
revokePermissionReference

Revokes a previously granted permission reference. The caller must be the author. Namespace 
api.tx.syloDataPermissions.revokePermissionReference
Type 
function revokePermissionReference(
  /// The account that was granted the permission
  grantee: AccountId,
)

​
Storage

​
PermissionRecords

Maps from grantor and grantee to a permission record id and the permission record itself. Namespace 
api.query.syloDataPermissions.PermissionRecords
Type 
type PermissionRecord {
	grantor: AccountId,
	permission: DataPermission,
	block: BlockNumber,
	expiry: Option<BlockNumber>,
	irrevocable: bool,
}

function PermissionRecords(
  data_author: AccountId,
  grantee: AccountId,
  data_id: Bytes
): Vec<(u32, PermissionRecord)>

​
TaggedPermissionRecords

Maps from grantor and grantee to a permission record id and the tagged permission record. Namespace 
api.query.syloDataPermissions.TaggedPermissionRecords
Type 
type TaggedPermissionRecord {
	permission: DataPermission,
	tags: Vec<Vec<Bytes>>,
	block: BlockNumber,
	expiry: Option<BlockNumber>,
	irrevocable: bool,
}

function TaggedPermissionRecords(
  data_author: AccountId,
  grantee: AccountId
): Vec<(u32, TaggedPermissionRecord)>

​
PermissionReferences

Stores permission references for off-chain records. Namespace 
api.query.syloDataPermissions.PermissionReferences
Type 
type PermissionReference {
	permission_record_id: Vec<Bytes>,
}

function PermissionReferences(
  data_author: AccountId,
  grantee: AccountId
): Option<PermissionReference>

​
Events

​
DataPermissionGranted

An account has been granted permission for a specific data record. Namespace 
api.events.syloDataPermissions.DataPermissionGranted
Type 
type DataPermissionGranted = {
  data_author: AccountId,
  grantor: AccountId,
  grantee: AccountId,
  data_id: Bytes,
  permission: DataPermission,
  expiry: Option<BlockNumber>,
  irrevocable: bool,
}

​
DataPermissionRevoked

An account’s permission has been revoked for a specific data record. Namespace 
api.events.syloDataPermissions.DataPermissionRevoked
Type 
type DataPermissionRevoked = {
  revoker: AccountId,
  grantee: AccountId,
  permission: DataPermission,
  data_id: Bytes,
}

​
ExpiredDataPermissionRemoved

An expired data permission has been automatically removed. Namespace 
api.events.syloDataPermissions.ExpiredDataPermissionRemoved
Type 
type ExpiredDataPermissionRemoved = {
  data_author: AccountId,
  grantee: AccountId,
  data_id: Bytes,
  permission_id: u32,
}

​
TaggedDataPermissionsGranted

An account has been granted tagged permissions. Namespace 
api.events.syloDataPermissions.TaggedDataPermissionsGranted
Type 
type TaggedDataPermissionsGranted = {
  grantor: AccountId,
  grantee: AccountId,
  permission: DataPermission,
  tags: Vec<Bytes>,
  expiry: Option<BlockNumber>,
  irrevocable: bool,
}

​
TaggedDataPermissionsRevoked

A tagged permission for an account has been revoked. Namespace 
api.events.syloDataPermissions.TaggedDataPermissionsRevoked
Type 
type TaggedDataPermissionsRevoked = {
  revoker: AccountId,
  grantee: AccountId,
  permission: DataPermission,
  tags: Vec<Bytes>,
}

​
PermissionReferenceGranted

An account has been granted a permission reference. Namespace 
api.events.syloDataPermissions.PermissionReferenceGranted
Type 
type PermissionReferenceGranted = {
  grantor: AccountId,
  grantee: AccountId,
  permission_record_id: Bytes,
}

​
PermissionReferenceRevoked

An account’s permission reference has been revoked. Namespace 
api.events.syloDataPermissions.PermissionReferenceRevoked
Type 
type PermissionReferenceRevoked = {
  grantor: AccountId,
  grantee: AccountId,
  permission_record_id: Bytes,
}

​
Errors

​
DataRecordDoesNotExist

Attempted to grant permissions for a data record that does not exist. Namespace 
api.errors.syloDataPermissions.DataRecordDoesNotExist

​
IrrevocableCannotBeExpirable

A permission that is set to irrevocable cannot also be set to have an expiry. Namespace 
api.errors.syloDataPermissions.IrrevocableCannotBeExpirable

​
InvalidExpiry

Expiry value for permission record is invalid. Namespace 
api.errors.syloDataPermissions.InvalidExpiry

​
ExceededMaxPermissions

Exceeded the maximum number of record permissions granted to a given account. Namespace 
api.errors.syloDataPermissions.ExceededMaxPermissions

​
MissingDistributePermission

Attempted to grant a permission as a delegate without the required DISTRIBUTE permission. Namespace 
api.errors.syloDataPermissions.MissingDistributePermission

​
CannotGrantDistributePermission

Distribute permissions can only be granted by the data author. Namespace 
api.errors.syloDataPermissions.CannotGrantDistributePermission

​
PermissionIrrevocable

An irrevocable permission cannot be revoked. Namespace 
api.errors.syloDataPermissions.PermissionIrrevocable

​
NotPermissionGrantor

Only the account that granted a permission or the data author can revoke a permission. Namespace 
api.errors.syloDataPermissions.NotPermissionGrantor

​
PermissionNotFound

Cannot revoke a permission that does not exist. Namespace 
api.errors.syloDataPermissions.PermissionNotFound

​
MissingValidationRecord

An accompanying verification record for the off-chain permission does not exist. Namespace 
api.errors.syloDataPermissions.MissingValidationRecord

​
PermissionReferenceAlreadyExists

An existing permission reference has already been granted. Namespace 
api.errors.syloDataPermissions.PermissionReferenceAlreadyExists

​
ExceededMaxExpiringPermissions

Exceeded the maximum number of permissions that can expire on the same block. Namespace 
api.errors.syloDataPermissions.ExceededMaxExpiringPermissions

​
InvalidString

String values in an RPC call, in either the inputs or outputs, are invalid. Namespace 
api.errors.syloDataPermissions.InvalidString