rules:
  # Catalog: for all non-public url access.
  - path: /product/vendor/<int>/product_code/<*>
    methods: [HEAD]
    groups:
      alw: [1]
      oa: ['*']
  - path: /product/localization/product/<int>
    methods: [GET]
    groups:
      alw: [1]
      oa: ['*']
  - path: /product/localization/product/<int>/language/<int>
    methods: [POST, DELETE]
    groups:
      alw: [1]

  - path: /product/product/<int>/copy/digital
    methods: [POST]
    groups:
      alw: [1]
      oa: ['*']
  - path: /product/product/<int>/copy/physical
    methods: [POST]
    groups:
      alw: [1]

  - path: /product/product/<int>
    methods: [GET, DELETE]
    groups:
      alw: [1]
      oa: ['*']
  # Catalog and analytic allowed.
  - path: /product/product/upc/<int>
    methods: [GET]
    groups:
      alw: [1, 3]
      oa: ['*']

  - path: /product/product/<int>/asset-version
    methods: [GET, PUT]
    groups:
      alw: [1]
      oa: ['*']

  # Admin: Allow all.
  - path: <*>
    methods: ['*']
    groups:
      alw: [4]
      oa: ['*']