# List of Barong administrators. # # Other parameters that you can set here can be found in Account, # Profile and Phone models (e.g. app/models/account.rb...); all the # model properties are listed at the very bottom of this models files. # # Note: email is the only required field here. users: - email: <%= @config['admin']['user'] %> password: <%= @config['admin']['pass'] %> role: superadmin state: active level: 2 levels: - key: email id: 1 value: verified description: "User enter a valid code after registration" - key: profile id: 2 value: verified description: "User personal documents have been verified" - key: access_phone id: 3 value: verified description: "User entered a valid code from sms" - key: card id: 4 value: verified description: "User card number have been verified" - key: iban id: 5 value: verified description: "User iban have been verified" - key: poa id: 6 value: verified description: "User card bank have been verified" - key: telephone id: 7 value: verified description: "User entered a valid code from ring call" - key: selfie id: 8 value: verified description: "User selfie documents have been verified" - key: owner_phone id: 9 value: verified description: "User owner mobile have been verified" - key: vip id: 10 value: verified description: "User Vip have been verified" restrictions: {} # - { category: whitelist, scope: country, value: UA, state: disabled } # - { category: maintenance, scope: all, value: all, state: disabled } # - { category: blacklist, scope: ip, value: 164.116.47.255, state: disabled, code: 433 } # - { category: blacklist, scope: ip_subnet, value: 164.116.47.0/24, state: disabled, code: 434 } # - { category: blacklist, scope: country, value: USA, state: disabled, code: 435 } # - { category: blacklist, scope: continent, value: SA, state: disabled, code: 436 } permissions: # SUPER ADMIN has an access to the whole system without any limits # so we can just grant him access to /api/v2/* - { role: superadmin, verb: all, path: api/v2, action: accept } <%- if @config['finex']['enabled'] -%> - { role: superadmin, verb: post, path: api/v2/dena/market/orders, action: drop } - { role: superadmin, verb: post, path: api/v2/dena/admin/orders, action: drop } <%- end -%> # Rango(ranger) access - { role: superadmin, verb: get, path: api/v2/ranger, action: accept } # we are watching after you 0_0 - { role: superadmin, verb: post, path: api/v2/, action: audit } - { role: superadmin, verb: put, path: api/v2/, action: audit } - { role: superadmin, verb: delete, path: api/v2/, action: audit } # ADMIN # admin has nearly full access to barong and peatio api, except managing permissions - { role: admin, verb: all, path: api/v2, action: accept } <%- if @config['finex']['enabled'] -%> - { role: admin, verb: post, path: api/v2/dena/market/orders, action: drop } - { role: admin, verb: post, path: api/v2/dena/admin/orders, action: drop } <%- end -%> # ranger access - { role: admin, verb: get, path: api/v2/ranger, action: accept } # Finex upstream access - { role: admin, verb: get, path: api/v2/open_finance, action: accept } # admin doesnt have access to manage platform roles and permissions - { role: admin, verb: all, path: api/v2/dalan/admin/permissions, action: drop } # admin doesnt have access to manage roles - { role: admin, verb: all, path: api/v2/dalan/admin/users/role, action: drop } # admin doesnt have access to admin activities - { role: admin, verb: all, path: api/v2/dalan/admin/activities/admin, action: drop } # we are watching after you 0_0 - { role: admin, verb: post, path: api/v2/, action: audit } - { role: admin, verb: put, path: api/v2/, action: audit } - { role: admin, verb: delete, path: api/v2/, action: audit } # ACCOUNTANT # accountant has a read access to Barong admin - { role: accountant, verb: get, path: api/v2/dalan/admin, action: accept } # accountant has a read access to Peatio financial information and creating of adjustments - { role: accountant, verb: get, path: api/v2/dena/admin/members, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/beneficiaries, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/currencies, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/blockchains, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/wallets, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/trading_fees, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/withdraw_limits, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/orders, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/markets, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/engine, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/trades, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/deposits, action: accept } - { role: accountant, verb: post, path: api/v2/dena/admin/deposits/new, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/withdraws, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/adjustments, action: accept } - { role: accountant, verb: post, path: api/v2/dena/admin/adjustments/new, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/assets, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/liabilities, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/revenues, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/expenses, action: accept } - { role: accountant, verb: get, path: api/v2/dena/admin/internal_transfers, action: accept } # accountant doesnt have access to see pending documents - { role: accountant, verb: get, path: api/v2/dalan/admin/users/documents/pending, action: drop } # accountant doesnt have access to manage platform roles and permissions - { role: accountant, verb: all, path: api/v2/dalan/admin/users/role, action: drop } - { role: accountant, verb: all, path: api/v2/dalan/admin/permissions, action: drop } # accountant doesnt have access to admin activities - { role: accountant, verb: all, path: api/v2/dalan/admin/activities/admin, action: drop } # we are watching after you 0_0 - { role: accountant, verb: post, path: api/v2/, action: audit } - { role: accountant, verb: put, path: api/v2/, action: audit } - { role: accountant, verb: delete, path: api/v2/, action: audit } # has standard user permissions to ACCOUNT, MARKET, RESOURCE modules - { role: accountant, verb: all, path: api/v2/dena/account, action: accept } - { role: accountant, verb: all, path: api/v2/dena/market, action: accept } - { role: accountant, verb: all, path: api/v2/finex/market, action: accept } - { role: accountant, verb: all, path: api/v2/dalan/resource, action: accept } - { role: accountant, verb: all, path: api/v2/dena/account/internal_transfers, action: accept } - { role: accountant, verb: all, path: api/v2/dena/swagger, action: accept } # Drop Peatio order endpoint requests <%- if @config['finex']['enabled'] -%> - { role: accountant, verb: post, path: api/v2/dena/market/orders, action: drop } - { role: accountant, verb: post, path: api/v2/dena/admin/orders, action: drop } <%- end -%> # ranger access - { role: accountant, verb: get, path: api/v2/ranger, action: accept } # applogic access - { role: accountant, verb: all, path: api/v2/applogic, action: accept } # get abilities - { role: accountant, verb: all, path: api/v2/dena/admin/abilities, action: accept } - { role: accountant, verb: all, path: api/v2/dalan/admin/abilities, action: accept } # COMPLIANCE - { role: compliance, verb: get, path: api/v2/dalan/admin, action: accept } # has an access to CRUD of user-related resources - { role: compliance, verb: get, path: api/v2/dena/admin/members, action: accept } - { role: compliance, verb: get, path: api/v2/dena/admin/beneficiaries, action: accept } - { role: compliance, verb: get, path: api/v2/dena/admin/currencies, action: accept } - { role: compliance, verb: get, path: api/v2/dena/admin/trades, action: accept } - { role: compliance, verb: get, path: api/v2/dena/admin/orders, action: accept } - { role: compliance, verb: all, path: api/v2/dalan/admin/users, action: accept } # has ability to see deposit, withdraw, operations (partial) - { role: compliance, verb: get, path: api/v2/dena/admin/deposits, action: accept } - { role: compliance, verb: get, path: api/v2/dena/admin/withdraws, action: accept } - { role: compliance, verb: get, path: api/v2/dena/admin/assets, action: accept } - { role: compliance, verb: get, path: api/v2/dena/admin/liabilities, action: accept } - { role: compliance, verb: get, path: api/v2/dena/admin/expenses, action: accept } - { role: compliance, verb: get, path: api/v2/dena/admin/markets, action: accept } - { role: compliance, verb: get, path: api/v2/dena/admin/engine, action: accept } # has no ability to see the configurations - { role: compliance, verb: all, path: api/v2/dena/admin/adjustments, action: drop } - { role: compliance, verb: all, path: api/v2/dena/admin/revenues, action: drop } - { role: compliance, verb: all, path: api/v2/dena/admin/blockchains, action: drop } - { role: compliance, verb: all, path: api/v2/dena/admin/wallets, action: drop } - { role: compliance, verb: all, path: api/v2/dena/admin/trading_fees, action: drop } - { role: compliance, verb: all, path: api/v2/dena/admin/withdraw_limits, action: drop } - { role: compliance, verb: all, path: api/v2/dalan/admin/restrictions, action: drop } # compliance doesnt have access to change users roles - { role: compliance, verb: all, path: api/v2/dalan/admin/users/role, action: drop } # compliance doesnt have access to admin activities - { role: compliance, verb: all, path: api/v2/dalan/admin/activities/admin, action: drop } # compliance doesnt have access to manage platform roles and permissions - { role: compliance, verb: all, path: api/v2/dalan/admin/permissions, action: drop } # we are watching after you 0_0 - { role: compliance, verb: post, path: api/v2/, action: audit } - { role: compliance, verb: put, path: api/v2/, action: audit } - { role: compliance, verb: delete, path: api/v2/, action: audit } # has standard user permissions to ACCOUNT, MARKET, RESOURCE modules - { role: compliance, verb: all, path: api/v2/dena/account, action: accept } - { role: compliance, verb: all, path: api/v2/dena/market, action: accept } - { role: compliance, verb: all, path: api/v2/finex/market, action: accept } - { role: compliance, verb: all, path: api/v2/dalan/resource, action: accept } - { role: compliance, verb: all, path: api/v2/dena/account/internal_transfers, action: accept } - { role: compliance, verb: all, path: api/v2/dena/swagger, action: accept } # Drop Peatio order endpoint requests <%- if @config['finex']['enabled'] -%> - { role: compliance, verb: post, path: api/v2/dena/market/orders, action: drop } - { role: compliance, verb: post, path: api/v2/dena/admin/orders, action: drop } <%- end -%> # ranger access - { role: compliance, verb: get, path: api/v2/ranger, action: accept } # applogic access - { role: compliance, verb: all, path: api/v2/applogic, action: accept } # get abilities - { role: compliance, verb: all, path: api/v2/dena/admin/abilities, action: accept } - { role: compliance, verb: all, path: api/v2/dalan/admin/abilities, action: accept } # TECHNICAL # has an access to CRUD of peatio admin functionality on market, blockchain, wallets, currencies - { role: technical, verb: get, path: api/v2/dalan/admin, action: accept } - { role: technical, verb: get, path: api/v2/dena/admin, action: accept } # technical has a configuration access to Peatio admin - { role: technical, verb: all, path: api/v2/dena/admin/blockchains, action: accept } - { role: technical, verb: all, path: api/v2/dena/admin/currencies, action: accept } - { role: technical, verb: all, path: api/v2/dena/admin/markets, action: accept } - { role: technical, verb: all, path: api/v2/dena/admin/wallets, action: accept } - { role: technical, verb: all, path: api/v2/dena/admin/trading_fees, action: accept } - { role: technical, verb: all, path: api/v2/dena/admin/withdraw_limits, action: accept } - { role: technical, verb: get, path: api/v2/dena/admin/internal_transfers, action: accept } - { role: technical, verb: all, path: api/v2/dena/admin/engine, action: accept } # technical has access to delete orders - { role: technical, verb: delete, path: api/v2/finex/admin/bulk/orders_by_id, action: accept } - { role: technical, verb: post, path: api/v2/finex/admin/orders/cancel, action: accept } # technical has an ability to create and update restrictions - { role: technical, verb: all, path: api/v2/dalan/admin/restrictions, action: accept } # has no ability to see and update Deposit, Withdraw, Adjustments - { role: technical, verb: all, path: api/v2/dena/admin/deposits, action: drop } - { role: technical, verb: all, path: api/v2/dena/admin/withdraws, action: drop } - { role: technical, verb: all, path: api/v2/dena/admin/adjustments, action: drop } # Finex upstream access - { role: technical, verb: get, path: api/v2/open_finance, action: accept } # technical doesnt have access to see pending documents - { role: technical, verb: get, path: api/v2/dalan/admin/users/documents/pending, action: drop } # technical doesnt have access to admin activities - { role: technical, verb: all, path: api/v2/dalan/admin/activities/admin, action: drop } # technical doesnt have access to manage platform roles and permissions - { role: technical, verb: all, path: api/v2/dalan/admin/permissions, action: drop } # we are watching after you 0_0 - { role: technical, verb: post, path: api/v2/, action: audit } - { role: technical, verb: put, path: api/v2/, action: audit } - { role: technical, verb: delete, path: api/v2/, action: audit } # has standard user permissions to ACCOUNT, MARKET, RESOURCE modules - { role: technical, verb: all, path: api/v2/dena/account, action: accept } - { role: technical, verb: all, path: api/v2/dena/market, action: accept } - { role: technical, verb: all, path: api/v2/finex/market, action: accept } - { role: technical, verb: all, path: api/v2/dalan/resource, action: accept } - { role: technical, verb: all, path: api/v2/dena/account/internal_transfers, action: accept } - { role: technical, verb: all, path: api/v2/dena/swagger, action: accept } # Drop Peatio order endpoint requests <%- if @config['finex']['enabled'] -%> - { role: technical, verb: post, path: api/v2/dena/market/orders, action: drop } - { role: technical, verb: post, path: api/v2/dena/admin/orders, action: drop } <%- end -%> # ranger access - { role: technical, verb: get, path: api/v2/ranger, action: accept } # applogic access - { role: technical, verb: all, path: api/v2/applogic, action: accept } # get abilities - { role: technical, verb: all, path: api/v2/dena/admin/abilities, action: accept } - { role: technical, verb: all, path: api/v2/dalan/admin/abilities, action: accept } # SUPPORT # has read only access to several statistic and user-related endpoints - { role: support, verb: get, path: api/v2/dalan/admin, action: accept } - { role: support, verb: get, path: api/v2/dena/admin, action: accept } # has no ability to see the configurations - { role: support, verb: all, path: api/v2/dena/admin/adjustments, action: drop } - { role: support, verb: all, path: api/v2/dena/admin/revenues, action: drop } - { role: support, verb: all, path: api/v2/dena/admin/blockchains, action: drop } - { role: support, verb: all, path: api/v2/dena/admin/wallets, action: drop } - { role: support, verb: all, path: api/v2/dena/admin/trading_fees, action: drop } - { role: support, verb: all, path: api/v2/dena/admin/withdraw_limits, action: drop } - { role: support, verb: all, path: api/v2/dalan/admin/restrictions, action: drop } - { role: support, verb: get, path: api/v2/dena/admin/internal_transfers, action: accept } - { role: support, verb: get, path: api/v2/dena/admin/engine, action: accept } # has ability to disable 2FA - { role: support, verb: post, path: api/v2/dalan/admin/users/update, action: accept } # support doesnt have access to admin activities - { role: support, verb: all, path: api/v2/dalan/admin/activities/admin, action: drop } # support doesnt have access to manage platform roles and permissions - { role: support, verb: all, path: api/v2/dalan/admin/permissions, action: drop } - { role: support, verb: all, path: api/v2/dalan/admin/permissions, action: drop } # we are watching after you 0_0 - { role: support, verb: post, path: api/v2/, action: audit } - { role: support, verb: put, path: api/v2/, action: audit } - { role: support, verb: delete, path: api/v2/, action: audit } # has standard user permissions to ACCOUNT, MARKET, RESOURCE modules - { role: support, verb: all, path: api/v2/dena/account, action: accept } - { role: support, verb: all, path: api/v2/dena/market, action: accept } - { role: support, verb: all, path: api/v2/finex/market, action: accept } - { role: support, verb: all, path: api/v2/dalan/resource, action: accept } - { role: support, verb: all, path: api/v2/dena/account/internal_transfers, action: accept } - { role: support, verb: all, path: api/v2/dena/swagger, action: accept } # Drop Peatio order endpoint requests <%- if @config['finex']['enabled'] -%> - { role: support, verb: post, path: api/v2/dena/market/orders, action: drop } - { role: support, verb: post, path: api/v2/dena/admin/orders, action: drop } <%- end -%> # ranger access - { role: support, verb: get, path: api/v2/ranger, action: accept } # applogic access - { role: support, verb: all, path: api/v2/applogic, action: accept } # get abilities - { role: support, verb: all, path: api/v2/dena/admin/abilities, action: accept } - { role: support, verb: all, path: api/v2/dalan/admin/abilities, action: accept } # TRADER # has standard user permissions to ACCOUNT, MARKET, RESOURCE modules - { role: trader, verb: all, path: api/v2/dena/account, action: accept } <%- if @config['finex']['enabled'] -%> - { role: trader, verb: get, path: api/v2/dena/market, action: accept } - { role: trader, verb: all, path: api/v2/finex/market, action: accept } - { role: trader, verb: post, path: api/v2/dena/market/orders, action: drop } <%- else -%> - { role: trader, verb: all, path: api/v2/dena/market, action: accept } <%- end -%> - { role: trader, verb: all, path: api/v2/dalan/resource, action: accept } - { role: trader, verb: all, path: api/v2/resource, action: accept } - { role: trader, verb: all, path: api/v2/dena/account/internal_transfers, action: accept } - { role: trader, verb: all, path: api/v2/dena/swagger, action: accept } # ranger access - { role: trader, verb: get, path: api/v2/ranger, action: accept } # Finex upstream access - { role: trader, verb: get, path: api/v2/open_finance, action: accept } # applogic access - { role: trader, verb: all, path: api/v2/applogic, action: accept } # MEMBER # has standard user permissions to ACCOUNT, MARKET, RESOURCE modules - { role: member, verb: all, path: api/v2/dena/account, action: accept } <%- if @config['finex']['enabled'] -%> - { role: member, verb: get, path: api/v2/dena/market, action: accept } - { role: member, verb: all, path: api/v2/finex/market, action: accept } - { role: member, verb: post, path: api/v2/dena/market/orders, action: drop } <%- else -%> - { role: member, verb: all, path: api/v2/dena/market, action: accept } <%- end -%> - { role: member, verb: all, path: api/v2/dalan/resource, action: accept } - { role: member, verb: all, path: api/v2/resource, action: accept } - { role: member, verb: all, path: api/v2/dena/account/internal_transfers, action: accept } - { role: member, verb: all, path: api/v2/dena/swagger, action: accept } # ranger access - { role: member, verb: get, path: api/v2/ranger, action: accept } # Finex upstream access - { role: member, verb: get, path: api/v2/open_finance, action: accept } # applogic access - { role: member, verb: all, path: api/v2/applogic, action: accept } # BROKER # has standard user permissions to ACCOUNT, MARKET, RESOURCE modules - { role: broker, verb: all, path: api/v2/dena/account, action: accept } <%- if @config['finex']['enabled'] -%> - { role: broker, verb: get, path: api/v2/dena/market, action: accept } - { role: broker, verb: all, path: api/v2/finex/market, action: accept } - { role: broker, verb: post, path: api/v2/dena/market/orders, action: drop } <%- else -%> - { role: broker, verb: all, path: api/v2/dena/market, action: accept } <%- end -%> - { role: broker, verb: all, path: api/v2/dalan/resource, action: accept } - { role: broker, verb: all, path: api/v2/resource, action: accept } - { role: broker, verb: all, path: api/v2/dena/account/internal_transfers, action: accept } - { role: broker, verb: all, path: api/v2/dena/swagger, action: accept } # ranger access - { role: broker, verb: get, path: api/v2/ranger, action: accept } # Finex upstream access - { role: broker, verb: get, path: api/v2/open_finance, action: accept } # applogic access - { role: broker, verb: all, path: api/v2/applogic, action: accept } # MAKER # has standard user permissions to ACCOUNT, MARKET, RESOURCE modules - { role: maker, verb: all, path: api/v2/dena/account, action: accept } <%- if @config['finex']['enabled'] -%> - { role: maker, verb: get, path: api/v2/dena/market, action: accept } - { role: maker, verb: all, path: api/v2/finex/market, action: accept } - { role: maker, verb: post, path: api/v2/dena/market/orders, action: drop } <%- else -%> - { role: maker, verb: all, path: api/v2/dena/market, action: accept } <%- end -%> - { role: maker, verb: all, path: api/v2/dalan/resource, action: accept } - { role: maker, verb: all, path: api/v2/resource, action: accept } - { role: maker, verb: all, path: api/v2/dena/account/internal_transfers, action: accept } - { role: maker, verb: all, path: api/v2/dena/swagger, action: accept } # ranger access - { role: maker, verb: get, path: api/v2/ranger, action: accept } # Finex upstream access - { role: maker, verb: get, path: api/v2/open_finance, action: accept } # applogic access - { role: maker, verb: all, path: api/v2/applogic, action: accept } # Service Account Maker # has standard user permissions to ACCOUNT, MARKET, RESOURCE modules - { role: sa_maker, verb: all, path: api/v2/dena/account, action: accept } <%- if @config['finex']['enabled'] -%> - { role: sa_maker, verb: get, path: api/v2/dena/market, action: accept } - { role: sa_maker, verb: all, path: api/v2/finex/market, action: accept } - { role: sa_maker, verb: post, path: api/v2/dena/market/orders, action: drop } <%- else -%> - { role: sa_maker, verb: all, path: api/v2/dena/market, action: accept } <%- end -%> - { role: sa_maker, verb: all, path: api/v2/dalan/resource, action: accept } - { role: sa_maker, verb: all, path: api/v2/dena/account/internal_transfers, action: accept } - { role: sa_maker, verb: all, path: api/v2/dena/swagger, action: accept } # Service Account can not interact with Password, 2FA, KYC, API keys, Beneficiary, Deposit and Withdraw - { role: sa_maker, verb: all, path: api/v2/dalan/resource/otp, action: drop } - { role: sa_maker, verb: all, path: api/v2/dalan/resource/phones, action: drop } - { role: sa_maker, verb: all, path: api/v2/dalan/resource/profiles, action: drop } - { role: sa_maker, verb: all, path: api/v2/dalan/resource/documents, action: drop } - { role: sa_maker, verb: all, path: api/v2/dalan/resource/addresses, action: drop } - { role: sa_maker, verb: all, path: api/v2/applogic/private/tenants, action: drop } - { role: sa_maker, verb: all, path: api/v2/dalan/resource/api_keys, action: drop } - { role: sa_maker, verb: all, path: api/v2/dalan/resource/users/password, action: drop } - { role: sa_maker, verb: all, path: api/v2/dena/account/deposit_address, action: drop } - { role: sa_maker, verb: all, path: api/v2/dena/account/withdraws, action: drop } - { role: sa_maker, verb: all, path: api/v2/dena/account/beneficiaries, action: drop } # Finex upstream access - { role: sa_maker, verb: get, path: api/v2/open_finance, action: accept } # ranger access - { role: sa_maker, verb: get, path: api/v2/ranger, action: accept } # applogic access - { role: sa_maker, verb: all, path: api/v2/applogic, action: accept }