{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "imports-v2/tree_entity_roles.json",
  "title": "Tree entity roles",
  "description": "A tree entity is a space, a folder or a document: the items of the sidebar tree, which can sit inside one another. This resource gives a user or a user group one or more roles on a space, a folder or a document. The roles are listed in `role_refs`: `reader`, `writer` and `admin` are the built-in roles, and your own roles come from `roles`. The access also applies to everything inside the space, folder or document. Write one record per space, folder or document and member. When the member is a group, every member of the group gets the roles of the group, and the import creates the access for the group as a whole, not for each user. Users who are not yet in the target company are added to it without an invitation email. A group that already exists in the target keeps its own members (see `user_groups`). A package with groups or roles of your own can be imported only by a user with the Members management permission, and only if the tariff includes groups. For example, `{\"external_id\": \"m-liam\", \"tree_entity_ref\": {\"resource\": \"spaces\", \"external_id\": \"s-sales\"}, \"member_ref\": {\"resource\": \"users\", \"external_id\": \"u-liam\"}, \"role_refs\": [\"writer\", \"r-editor\"]}` gives the user `u-liam` the built-in writer role and the role `r-editor` in the space `s-sales`, and `{\"external_id\": \"m-analytics\", \"tree_entity_ref\": {\"resource\": \"folders\", \"external_id\": \"f-handbook\"}, \"member_ref\": {\"resource\": \"user_groups\", \"external_id\": \"g-analytics\"}, \"role_refs\": [\"reader\"]}` gives the group `g-analytics` the reader role in the folder `f-handbook`.",
  "type": "object",
  "properties": {
    "external_id": {
      "type": "string",
      "minLength": 1,
      "maxLength": 512,
      "description": "Your own identifier of the record, for example `k-mrr`, unique within the resource across all of its files and case sensitive. Other records refer to this one by it."
    },
    "tree_entity_ref": {
      "type": "object",
      "properties": {
        "resource": {
          "type": "string",
          "enum": [
            "spaces",
            "folders",
            "documents"
          ]
        },
        "external_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 512
        }
      },
      "required": [
        "resource",
        "external_id"
      ],
      "additionalProperties": false,
      "x-refs": [
        "spaces",
        "folders",
        "documents"
      ],
      "description": "The tree entity (a space, a folder or a document): an object with `resource` (`spaces`, `folders` or `documents`) and the `external_id` of that record."
    },
    "member_ref": {
      "type": "object",
      "properties": {
        "resource": {
          "type": "string",
          "enum": [
            "users",
            "user_groups"
          ]
        },
        "external_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 512
        }
      },
      "required": [
        "resource",
        "external_id"
      ],
      "additionalProperties": false,
      "x-refs": [
        "users",
        "user_groups"
      ],
      "description": "Who gets access: an object with `resource` (`users` or `user_groups`) and the `external_id` of that user or group."
    },
    "role_refs": {
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 512,
        "x-ref": "roles",
        "x-builtins": [
          "reader",
          "writer",
          "admin"
        ]
      },
      "uniqueItems": true,
      "minItems": 1,
      "not": {
        "anyOf": [
          {
            "allOf": [
              {
                "not": {
                  "items": {
                    "not": {
                      "const": "reader"
                    }
                  }
                }
              },
              {
                "not": {
                  "items": {
                    "not": {
                      "const": "writer"
                    }
                  }
                }
              }
            ]
          },
          {
            "allOf": [
              {
                "not": {
                  "items": {
                    "not": {
                      "const": "reader"
                    }
                  }
                }
              },
              {
                "not": {
                  "items": {
                    "not": {
                      "const": "admin"
                    }
                  }
                }
              }
            ]
          },
          {
            "allOf": [
              {
                "not": {
                  "items": {
                    "not": {
                      "const": "writer"
                    }
                  }
                }
              },
              {
                "not": {
                  "items": {
                    "not": {
                      "const": "admin"
                    }
                  }
                }
              }
            ]
          }
        ]
      },
      "description": "The roles the member has in that space, folder or document: at least one, each once. The built-in roles `reader`, `writer` and `admin` (Commentator, Writer and Administrator in the app) are levels of access, so give at most one of them. Next to it, give as many of your own roles from `roles` as the member has in the source system, for example `[\"writer\", \"r-developer\", \"r-reviewer\"]`. The permissions of all the roles are added up; the member card in the app shows one of them."
    },
    "access_mod": {
      "type": "string",
      "enum": [
        "all",
        "related_only"
      ],
      "description": "`all` to see everything in the space, folder or document, `related_only` to see only the items related to the member. The default is `all`. `related_only` works only with the built-in `reader` or `writer` role and no role of your own in the record; a role of your own decides what its holders see through its own permissions; `admin` always sees everything.",
      "default": "all"
    }
  },
  "required": [
    "external_id",
    "tree_entity_ref",
    "member_ref",
    "role_refs"
  ],
  "additionalProperties": false,
  "allOf": [
    {
      "if": {
        "required": [
          "access_mod"
        ],
        "properties": {
          "access_mod": {
            "const": "related_only"
          }
        }
      },
      "then": {
        "properties": {
          "role_refs": {
            "items": {
              "enum": [
                "reader",
                "writer"
              ]
            }
          }
        }
      }
    }
  ]
}