authz

const (
	// Agent axis — member (AccessUser) suffices.
	AgentGet          Action = "agent.get"
	AgentUpdate       Action = "agent.update"
	AgentLifecycle    Action = "agent.lifecycle" // stop / start / suspend
	AgentGit          Action = "agent.git"       // connect / disconnect / read git binding
	AgentRunView      Action = "agent.run.view"  // runs list / get / logs (admin: runs span all users)
	AgentMembersView  Action = "agent.members.view"
	AgentToolsView    Action = "agent.tools.view"
	AgentBuildsView   Action = "agent.builds.view"  // builds list / get / log stream (admin)
	AgentConversation Action = "agent.conversation" // create / list web conversations
	AgentModelsView   Action = "agent.models.view"
	AgentClone        Action = "agent.clone" // fork this agent's code into a new agent (member of source; also needs TenantAgentClone)
	AgentFileResolve  Action = "agent.file.resolve"

	// Agent axis — owner (AccessAdmin) required.
	AgentDelete            Action = "agent.delete"
	AgentBuildManage       Action = "agent.build.manage" // upgrade / rollback / cancel build
	AgentMembersManage     Action = "agent.members.manage"
	AgentWebhooksView      Action = "agent.webhooks.view"
	AgentSchedulesView     Action = "agent.schedules.view"
	AgentScheduleFire      Action = "agent.schedule.fire"
	AgentConnections       Action = "agent.connections"    // credentials / MCP / env-vars
	AgentExecEndpoints     Action = "agent.exec_endpoints" // SSH exec-endpoint config
	AgentSiblings          Action = "agent.siblings"
	AgentModelsUpdate      Action = "agent.models.update"
	AgentRoutesView        Action = "agent.routes.view"
	AgentManagedBotCreate  Action = "agent.managed_bot.create"
	AgentIntegrationInvoke Action = "agent.integration.invoke"

	// Tenant axis.
	TenantCatalogView         Action = "tenant.catalog.view"           // read providers/models/capabilities catalog: user+
	TenantUserView            Action = "tenant.user.view"              // read tenant user directory (id/email/display_name): user+
	TenantAgentCreate         Action = "tenant.agent.create"           // create an agent: manager+
	TenantAgentList           Action = "tenant.agent.list"             // list agents visible to the caller: user+
	TenantAgentListAll        Action = "tenant.agent.list_all"         // list every agent in the tenant: admin
	TenantAgentMembersSelfAdd Action = "tenant.agent.members.self_add" // escape: tenant admin adds self to an agent they're not yet a member of: admin
	TenantAgentLifecycleAny   Action = "tenant.agent.lifecycle_any"    // stop/start/suspend an agent the caller isn't a member of: admin
	TenantAgentDeleteAny      Action = "tenant.agent.delete_any"       // delete an agent the caller isn't a member of: admin
	TenantAgentClone          Action = "tenant.agent.clone"            // clone an agent (produces a new agent): manager+ (paired with AgentClone member gate)
	TenantAgentTransferAny    Action = "tenant.agent.transfer_any"     // transfer an agent the caller doesn't own: admin
	TenantBridgeList          Action = "tenant.bridge.list"            // list bridges visible to the caller: user+
	TenantBridgeListAll       Action = "tenant.bridge.list_all"        // list every bridge in the tenant: admin
	TenantBridgeCreate        Action = "tenant.bridge.create"          // any bridge: manager+
	TenantBridgeUpdateAny     Action = "tenant.bridge.update_any"      // edit a bridge the caller doesn't own: admin
	TenantBridgeDeleteAny     Action = "tenant.bridge.delete_any"      // delete a bridge the caller doesn't own: admin
	TenantBridgeSystem        Action = "tenant.bridge.system"          // system (agent-less) bridge: admin
	TenantManagerBotConfig    Action = "tenant.manager_bot.config"     // configure the Telegram-managed-bots manager bot token: admin
	TenantUserManage          Action = "tenant.user.manage"
	TenantProviderView        Action = "tenant.provider.view" // list configured providers (no secrets) for model selection: manager+
	TenantProviderManage      Action = "tenant.provider.manage"
	TenantSettingsView        Action = "tenant.settings.view" // read system defaults (agent-create prefill): user+
	TenantSettingsUpdate      Action = "tenant.settings.update"
	TenantIdentityManage      Action = "tenant.identity.manage"     // link / list / unlink caller's own platform identities: user+
	TenantIdentityManageAll   Action = "tenant.identity.manage_all" // list / unlink any user's platform identities: admin
	TenantSelfProfileUpdate   Action = "tenant.self.profile.update" // update the caller's own profile: user+
	TenantSelfPasskeyManage   Action = "tenant.self.passkey.manage" // register / list / rename / delete the caller's own passkeys + set/remove own password: user+
	ResourceInventoryView     Action = "resource.inventory.view"    // list resources available through ownership or grants: user+
	ResourceView              Action = "resource.view"              // authenticated precondition; resource capability checked by AuthorizeResource
	ResourceBind              Action = "resource.bind"              // authenticated precondition; resource capability checked by AuthorizeResource
	ResourceManage            Action = "resource.manage"            // authenticated precondition; resource capability checked by AuthorizeResource
	TenantGroupView           Action = "tenant.group.view"          // list groups + their grants: admin
	TenantModelGrantManage    Action = "tenant.model_grant.manage"  // grant/revoke which (provider, model) a group may use: admin
	TenantUsageView           Action = "tenant.usage.view"          // read the LLM spend ledger rollups (billing/usage): admin
)

const (
	AxisAgent         Axis = iota // requires a per-agent access level
	AxisTenant                    // requires a tenant role
	AxisIntegration               // agent admin or active codegen build for this agent
	AxisAuthenticated             // requires a registered user; another gate applies domain capability
)

const (
	// KindRegisteredUser — authenticated via a user JWT. UserID and
	// TenantRole are set.
	KindRegisteredUser Kind = iota
	// KindAnonymousUser — a human with no account (bridge public DM).
	// Resolves to AccessPublic; may do public-reachable actions but no
	// member/admin ones.
	KindAnonymousUser
	// KindTrigger — no human at all (cron/webhook). Cannot delegate as a
	// user; agent-axis actions and A2A initiation are denied.
	KindTrigger
	// KindCodegen is an active agent build using its narrow integration
	// credential. It has no tenant or ordinary agent standing.
	KindCodegen
)