access

var (
	ReadCaps = []Capability{CapProjectList, CapProjectRead, CapChangeList, CapChangeRead, CapRunRead,
		CapEvidenceRead, CapConformanceRead, CapReleaseRead, CapDeploymentRead, CapSecretRead}
	ContributorCaps = append(append([]Capability{}, ReadCaps...),
		CapChangeCreate, CapChangeUpdateBrief, CapChangeNarrative, CapChangeWriteRevision, CapChangeAttach, CapChangeRunChecks,
		CapChangePreview, CapChangeInvokeLane, CapChangeRequestLand, CapEvidenceAttach,
		CapConformanceRev)
	MaintainerCaps = append(append([]Capability{}, ContributorCaps...),
		CapChangeLand, CapChangeAbandon, CapChangeSendBack, CapRunOperate, CapDeploymentOperate,
		CapProjectServices, CapProjectIntegrations, CapProjectGuidance, CapProjectWorkflow,
		CapProjectWayOfWorking, CapProjectImport, CapConformanceFix, CapConformanceAI,
		CapProjectManageMembers, CapSecretBind, CapDeploymentDeploy)
	OwnerCaps = append(append([]Capability{}, MaintainerCaps...),
		CapProjectConfigure, CapProjectDelete, CapProjectModelProfile, CapDeploymentBind, CapDeploymentTeardown, CapDeploymentRestore)
	// Administration capabilities summarized by the account menu.
	AmenderCaps = []Capability{CapStandardsGuidance, CapStandardsPacks, CapStandardsPolicies,
		CapExecWorkflows, CapIntegrationServices, CapIntegrationDeps}
)

var Definitions = map[Capability]Definition{
	CapInstanceReadPublic: {"read the explicitly public instance surface", readInherits, "read"},
	CapInstitutionRead:    {"see users, groups, roles and grants", nil, "read"},

	CapProjectList:          {"discover visible projects", readInherits, "read"},
	CapProjectRead:          {"read one project's source-facing state", readInherits, "read"},
	CapProjectCreate:        {"create a project for an allowed owning group", []ScopeKind{ScopeGroup}, "mutate"},
	CapProjectConfigure:     {"change ordinary project metadata", nil, "mutate"},
	CapProjectDelete:        {"permanently remove a project", nil, "admin"},
	CapProjectManageMembers: {"change a project's roster and project roles", nil, "admin"},
	CapProjectImport:        {"import an external branch or tree", nil, "mutate"},

	CapChangeList:          {"list changes", readInherits, "read"},
	CapChangeRead:          {"read a change", readInherits, "read"},
	CapChangeCreate:        {"open a change", nil, "mutate"},
	CapChangeUpdateBrief:   {"edit a change's brief", nil, "mutate"},
	CapChangeNarrative:     {"refresh a change's So far summary", nil, "mutate"},
	CapChangeWriteRevision: {"contribute source revisions to a change", nil, "mutate"},
	CapChangeAttach:        {"attach evidence to a change", nil, "mutate"},
	CapChangeRunChecks:     {"run a change's checks", nil, "mutate"},
	CapChangePreview:       {"boot a change's preview", nil, "mutate"},
	CapChangeInvokeLane:    {"start an allowed lane on a change", nil, "mutate"},
	CapChangeSendBack:      {"send a change back to its author", nil, "mutate"},
	CapChangeAbandon:       {"abandon a change", nil, "mutate"},
	CapChangeRequestLand:   {"hand a proposed tip off for landing", nil, "mutate"},
	CapChangeLand:          {"operate a landing attempt: restart, resume, complete an unapproved lane", nil, "mutate"},
	CapChangeApprove:       {"assent at an approval step", nil, "approve"},
	CapChangeOverride:      {"bypass a failed gate with a reason", nil, "approve"},

	CapRunRead: {"read a run", readInherits, "read"},

	CapRunOperate:      {"advance, retry or stop a run", nil, "mutate"},
	CapEvidenceRead:    {"read evidence", readInherits, "read"},
	CapEvidenceAttach:  {"attach evidence to a run", nil, "mutate"},
	CapConformanceRead: {"read conformance", readInherits, "read"},
	CapConformanceRev:  {"run a read-only conformance review", nil, "mutate"},
	CapConformanceAI:   {"confirm one exact AI verdict", nil, "approve"},
	CapConformanceFix:  {"start a remediation", nil, "mutate"},

	CapExceptionApprove: {"approve a conformance exception in a dimension", nil, "approve"},
	CapExceptionRevoke:  {"revoke a conformance exception", nil, "approve"},

	CapProjectWayOfWorking: {"select the project's way of working", nil, "execute"},
	CapProjectGuidance:     {"change what guidance the project adopts", nil, "execute"},
	CapProjectServices:     {"change the project's attached services", nil, "execute"},
	CapProjectIntegrations: {"attach or wire integrations to the project", nil, "execute"},
	CapProjectModelProfile: {"choose the project's model profile", nil, "execute"},
	CapProjectWorkflow:     {"select or change the project's workflow copy", nil, "execute"},
	CapReleaseRead:         {"read releases", readInherits, "read"},
	CapReleasePromote:      {"promote a release to a wider tier", nil, "release"},
	CapDeploymentRead:      {"read deployments", readInherits, "read"},
	CapDeploymentOperate:   {"restart or rebuild a deployment, and read its parts' recent logs", nil, "mutate"},
	CapDeploymentBind:      {"point a standing deployment at a target", nil, "mutate"},
	CapDeploymentDeploy:    {"ship a bundle to a standing deployment", nil, "release"},
	CapDeploymentTeardown:  {"remove a deployment's deployment (never its data)", nil, "mutate"},
	CapDeploymentRestore:   {"fill a deployment's data from a copy, or check a copy comes back", nil, "mutate"},

	CapIdentityUsers:  {"manage user accounts", nil, "admin"},
	CapIdentityGroups: {"manage groups", nil, "admin"},
	CapIdentityAuth:   {"manage authentication settings", nil, "admin"},

	CapAuthzGrants:       {"grant and revoke roles and capabilities", nil, "admin"},
	CapStandardsGuidance: {"edit the guidance library", nil, "execute"},
	CapStandardsPacks:    {"edit packs", nil, "execute"},
	CapStandardsPolicies: {"edit policies and the policy library", nil, "execute"},
	CapStandardsEvals:    {"read evals of models and pack versions", nil, "read"},
	CapExecWorkflows:     {"edit workflow definitions", nil, "execute"},

	CapIntegrationConnector: {"manage connectors and provider bindings", nil, "admin"},
	CapIntegrationServices:  {"manage service kinds", nil, "execute"},
	CapIntegrationDeps:      {"manage dependency kinds", nil, "execute"},
	CapModelsBindings:       {"manage model provider bindings", nil, "admin"},
	CapModelsSlots:          {"manage model slots", nil, "admin"},
	CapPlatformTargets:      {"manage deploy targets", nil, "admin"},

	CapPlatformOperate: {"operate the platform", nil, "admin"},
	CapAuditRead:       {"read the audit log", readInherits, "read"},

	CapSecretRead:   {"read secret declarations and bindings (names, stores, versions; never values)", readInherits, "read"},
	CapSecretBind:   {"bind a project's secrets to a store, put a value into the built-in store, choose a deployment's profile", nil, "mutate"},
	CapSecretReveal: {"reveal a secret's value held by the built-in store, on the record (administrators only)", nil, "mutate"},
}

var ErrAuthorityUnavailable = errors.New("access authority is not configured")

var ErrGrantRevoked = errors.New("grant already revoked")

var ErrPrincipalRequired = fault.New(fault.Unauthenticated, "a verified principal is required")

var Scopes = []Scope{
	{"apptown:user:read", "read your projects, Changes, checks, evidence and runs", ReadCaps},
	{"apptown:change:create", "open Changes in your name", []Capability{CapChangeCreate, CapChangeUpdateBrief, CapChangeNarrative}},
	{"apptown:change:write", "push revisions to Changes you may write", []Capability{CapChangeWriteRevision}},
	{"apptown:change:check", "run a Change's checks", []Capability{CapChangeRunChecks}},
	{"apptown:change:preview", "boot a Change's preview", []Capability{CapChangePreview}},
	{"apptown:change:request-land", "hand a Change off for approval", []Capability{CapChangeRequestLand}},
	{"apptown:evidence:attach", "attach evidence to a Change", []Capability{CapChangeAttach, CapEvidenceAttach}},

	{"apptown:project:create", "create projects in your name", []Capability{CapProjectCreate}},
	{"apptown:change:run", "put AppTown's own agent to work on a Change", []Capability{CapChangeInvokeLane}},
	{"apptown:change:return", "send a Change back with a note, or abandon it", []Capability{CapChangeSendBack, CapChangeAbandon}},
}

var StockRoles = []Role{
	{Name: RoleInstanceAdmin, Title: "Instance administrator", Scope: ScopeInstance, Surfaced: true,
		Description: "The sovereign: holds every capability on this instance.", Caps: AllCapabilities()},
	{Name: RoleStandardsAdmin, Title: "Standards administrator", Scope: ScopeInstance,
		Description: "Manages guidance, packs and policies (the amender).",
		Caps:        []Capability{CapStandardsGuidance, CapStandardsPacks, CapStandardsPolicies, CapStandardsEvals}},
	{Name: RoleExecutionAdmin, Title: "Execution administrator", Scope: ScopeInstance,
		Description: "Manages executable workflow definitions.",
		Caps:        []Capability{CapExecWorkflows}},
	{Name: RoleIntegrationAdmin, Title: "Integration administrator", Scope: ScopeInstance,
		Description: "Manages connectors, service and dependency kinds, model bindings.",
		Caps:        []Capability{CapIntegrationConnector, CapIntegrationServices, CapIntegrationDeps, CapModelsBindings, CapModelsSlots}},
	{Name: RoleReleaseManager, Title: "Release manager", Scope: ScopeInstance, Surfaced: false,
		Description: "Promotes releases to wider tiers (the releaser).",
		Caps:        []Capability{CapReleaseRead, CapReleasePromote, CapDeploymentRead, CapDeploymentDeploy}},
	{Name: RoleAuditor, Title: "Auditor", Scope: ScopeInstance,
		Description: "Reads everything, changes nothing.",
		Caps:        append(append([]Capability{}, ReadCaps...), CapInstitutionRead, CapAuditRead, CapStandardsEvals)},
	{Name: RoleProjectCreator, Title: "Project creator", Scope: ScopeInstance, Surfaced: true,
		Description: "Creates projects through approved creation profiles.",
		Caps:        []Capability{CapProjectCreate, CapProjectList}},

	{Name: RoleGroupViewer, Title: "Group viewer", Scope: ScopeGroup,
		Description: "Discovers projects visible through this group.", Caps: []Capability{CapProjectList}},
	{Name: RoleGroupMember, Title: "Group member", Scope: ScopeGroup, Surfaced: true,
		Description: "Belongs to the group. Carries no project capability by itself.", Caps: []Capability{}},
	{Name: RoleGroupCreator, Title: "Group project creator", Scope: ScopeGroup,
		Description: "Creates projects owned by the group.", Caps: []Capability{CapProjectCreate}},
	{Name: RoleGroupMaintainer, Title: "Group maintainer", Scope: ScopeGroup,
		Description: "Reserved group office; currently carries no operation permissions.",
		Caps:        []Capability{}},
	{Name: RoleGroupOwner, Title: "Group owner", Scope: ScopeGroup, Surfaced: true,
		Description: "Creates projects owned by the group.",
		Caps:        []Capability{CapProjectCreate}},
	{Name: RoleGroupAuditor, Title: "Group auditor", Scope: ScopeGroup,
		Description: "Reads projects and evidence visible through this group.",
		Caps:        append(append([]Capability{}, ReadCaps...), CapAuditRead)},

	{Name: RoleProjectViewer, Title: "Project viewer", Scope: ScopeProject, Surfaced: true,
		Description: "Reads the project, its changes, runs, evidence and deployments.", Caps: ReadCaps},
	{Name: RoleProjectContrib, Title: "Project contributor", Scope: ScopeProject, Surfaced: true,
		Description: "Opens changes, contributes revisions, runs checks, previews, hands off for landing.",
		Caps:        ContributorCaps},
	{Name: RoleProjectMaintainer, Title: "Project maintainer", Scope: ScopeProject, Surfaced: true,
		Description: "Contributor plus landing, abandoning, operating runs and deployments, and project configuration.",
		Caps:        MaintainerCaps},
	{Name: RoleProjectApprover, Title: "Project approver", Scope: ScopeProject, Surfaced: true,
		Description: "Approves at approval steps that name them. Need not write code or land.",
		Caps:        append(append([]Capability{}, ReadCaps...), CapChangeApprove, CapChangeOverride, CapExceptionApprove, CapExceptionRevoke)},
	{Name: RoleProjectOwner, Title: "Project owner", Scope: ScopeProject, Surfaced: true,
		Description: "Maintainer plus membership, configuration and deletion authority.",
		Caps:        OwnerCaps},
}