Access Control problem in hyperledger composer for non-admin participants - hyperledger

Question

I got a question regarding access control in hyperledger composer.
I have read and utilized the instructions in Hyperledger Composer v0.19 Hiding Historian in ACL, but still, I have no success.
I want to have the following scenarios:
We have different types of assets in a namespace called 'org.example.assets'. The code is like the following
namespace org.example.assets
import org.example.*
abstract asset exampleAsset identified by Id
{
o String Id
--> exampleParticipant owner
}
asset myAsset extends exampleAsset
{
o String title
o String description
o String criteriaUrl
o String logoUrl
--> exampleParticipant issuer
}
I want owners of the assets have the ability to access them, and no other participants. Example participant is simply inheriting Participant and is placed in org.example namespace.
I do not want every participant to watch the whole historian; he/she can only see the records of transactions made by him/herself
here is the permissions.acl file I have so far
rule Participant_CanAccessOwnAssets {
description: "owner has full access"
participant(p): "org.example.exampleParticipant"
operation: ALL
resource(r): "org.example.assets.exampleAsset"
condition: (p.getIdentifier() == r.owner.getIdentifier())
action: ALLOW
}
rule Participant_CanOnlyReadOwnHistorian {
description: "each party should be able to read its own record"
participant(p): "org.example.exampleParticipant"
operation: READ
resource(r): "org.hyperledger.composer.system.HistorianRecord"
condition: (p.getIdentifier() == r.participantInvoking.getIdentifier())
action: ALLOW
}
rule Participants_DenyAccessToHistorian {
description: "participants cannot access general historian"
participant: "org.example.exampleParticipant"
operation: READ
resource: "org.hyperledger.composer.system.HistorianRecord"
action: DENY
}
rule Participant_CanReadNetwork {
description: "participants can read (connect to) the business network"
participant: "org.example.exampleParticipant"
operation: READ
resource: "org.hyperledger.composer.system.Network"
action: ALLOW
}
rule NetworkAdminUser {
description: "Grant business network administrators full access to user resources"
participant: "org.hyperledger.composer.system.NetworkAdmin"
operation: ALL
resource: "**"
action: ALLOW
}
rule NetworkAdminSystem {
description: "Grant business network administrators full access to system resources"
participant: "org.hyperledger.composer.system.NetworkAdmin"
operation: ALL
resource: "org.hyperledger.composer.system.**"
action: ALLOW
}
I connect to composer playground using my admin card, then I create a new participant and issue and identity for that paricipant. but when I try connecting to the network using my newly created card, I get the following error
Error: transaction returned with failure: AccessException: Participant 'org.pledger.PledgerParticipant#neo' does not have 'READ' access to resource 'org.hyperledger.composer.system.AssetRegistry#org.hyperledger.composer.system.HistorianRecord'
what should I do to solve this problem?
I guess there is a problem with this rule regarding the inheritance I am using, generalizing that any assets inheriting from abstract exampleAsset has an owner, but is this causing my problem?
rule Participant_CanAccessOwnAssets {
description: "owner has full access"
participant(p): "org.example.exampleParticipant"
operation: ALL
resource(r): "org.example.assets.exampleAsset"
condition: (p.getIdentifier() == r.owner.getIdentifier())
action: ALLOW
}

Answer 1

Before we get to the topic, just two comments regarding the ACL file:
On line 13, there is a typo ("paricipant")
On line 5, it should be "org.example.exampleAsset"
As for the question whether inheritance is an issue here, I'm not sure. But for example in the sample network "letters of credit", we also see a relationship added to an abstract class. What that means for your access control rule file is another story.
Have you tried adding the relationship on the sub classes to see if that works?