permissions

type AccessLevel struct {
	// Allowed indicates if access is allowed.
	Allowed bool `json:"allowed" yaml:"allowed"`
	// RequireMFA indicates if MFA is required.
	RequireMFA bool `json:"require_mfa,omitempty" yaml:"require_mfa,omitempty"`
	// Conditions indicates if there are conditions.
	Conditions bool `json:"conditions,omitempty" yaml:"conditions,omitempty"`
	// RateLimit indicates if there is rate limiting.
	RateLimit bool `json:"rate_limit,omitempty" yaml:"rate_limit,omitempty"`
}

type Analyzer struct {
	// contains filtered or unexported fields
}

type AuditEntry struct {
	// Timestamp is when the action occurred.
	Timestamp string `json:"timestamp" yaml:"timestamp"`
	// Service is the service name.
	Service string `json:"service" yaml:"service"`
	// Method is the method name.
	Method string `json:"method" yaml:"method"`
	// UserID is the user who performed the action.
	UserID string `json:"user_id" yaml:"user_id"`
	// Roles are the user's roles.
	Roles []string `json:"roles" yaml:"roles"`
	// Action is the permission action.
	Action string `json:"action" yaml:"action"`
	// Resource is the resource being accessed.
	Resource string `json:"resource" yaml:"resource"`
	// ResourceID is the specific resource ID.
	ResourceID string `json:"resource_id,omitempty" yaml:"resource_id,omitempty"`
	// Allowed indicates if access was granted.
	Allowed bool `json:"allowed" yaml:"allowed"`
	// Reason explains why access was granted/denied.
	Reason string `json:"reason,omitempty" yaml:"reason,omitempty"`
}

type AuditIssue struct {
	// RuleID is the rule identifier.
	RuleID string `json:"rule_id" yaml:"rule_id"`
	// Severity is the issue severity.
	Severity IssueSeverity `json:"severity" yaml:"severity"`
	// Service is the affected service.
	Service string `json:"service" yaml:"service"`
	// Method is the affected method.
	Method string `json:"method,omitempty" yaml:"method,omitempty"`
	// Message describes the issue.
	Message string `json:"message" yaml:"message"`
	// Fix provides a fix suggestion.
	Fix string `json:"fix,omitempty" yaml:"fix,omitempty"`
}

type AuditRule struct {
	ID          string
	Name        string
	Description string
	Severity    IssueSeverity
	Check       func(service *ServicePermissions, method string, perm *Permission) *AuditIssue
}

type Condition struct {
	// Field is the field to check.
	Field string `json:"field" yaml:"field"`
	// Operator is the comparison operator.
	Operator ConditionOperator `json:"operator" yaml:"operator"`
	// Source is where to get the comparison value.
	Source string `json:"source" yaml:"source"`
	// Value is a static comparison value (if Source is not set).
	Value interface{} `json:"value,omitempty" yaml:"value,omitempty"`
}

type ConditionOperator string

type DiffType string

type Generator struct {
	// contains filtered or unexported fields
}

type GeneratorOptions struct {
	// Framework is the authorization framework (go, casbin, opa).
	Framework string `json:"framework" yaml:"framework"`
	// Package is the generated package name.
	Package string `json:"package" yaml:"package"`
	// OutputDir is the output directory.
	OutputDir string `json:"output_dir" yaml:"output_dir"`
	// GenerateConstants generates constants for actions/roles/scopes.
	GenerateConstants bool `json:"generate_constants" yaml:"generate_constants"`
	// IncludeTests generates test files.
	IncludeTests bool `json:"include_tests" yaml:"include_tests"`
}

type IssueSeverity int

type Matrix struct {
	Services []string
	Methods  map[string][]string // service -> methods
	Roles    []string
	Scopes   []string
	Access   map[string]map[string]*AccessLevel // "service.method" -> role/scope -> access
}

type MethodPermission struct {
	// Service is the service name.
	Service string `json:"service" yaml:"service"`
	// Method is the method name.
	Method string `json:"method" yaml:"method"`
	// Permission is the permission configuration.
	Permission *Permission `json:"permission" yaml:"permission"`
}

type Parser struct {
	// contains filtered or unexported fields
}

type Permission struct {
	// Action is the permission action (e.g., "read", "write", "delete").
	Action string `json:"action" yaml:"action"`
	// Roles lists allowed roles.
	Roles []string `json:"roles,omitempty" yaml:"roles,omitempty"`
	// Scopes lists required OAuth scopes.
	Scopes []string `json:"scopes,omitempty" yaml:"scopes,omitempty"`
	// Conditions are ABAC conditions.
	Conditions []Condition `json:"conditions,omitempty" yaml:"conditions,omitempty"`
	// AllowSelf allows users to access their own resources.
	AllowSelf bool `json:"allow_self,omitempty" yaml:"allow_self,omitempty"`
	// RequireMFA requires multi-factor authentication.
	RequireMFA bool `json:"require_mfa,omitempty" yaml:"require_mfa,omitempty"`
	// AuditLog enables audit logging for this action.
	AuditLog bool `json:"audit_log,omitempty" yaml:"audit_log,omitempty"`
	// RateLimit sets rate limiting for this action.
	RateLimit *RateLimit `json:"rate_limit,omitempty" yaml:"rate_limit,omitempty"`
	// Public makes this endpoint public (no auth required).
	Public bool `json:"public,omitempty" yaml:"public,omitempty"`
}

type PermissionDiff struct {
	// Type is the type of difference.
	Type DiffType `json:"type" yaml:"type"`
	// Service is the service name.
	Service string `json:"service" yaml:"service"`
	// Method is the method name.
	Method string `json:"method" yaml:"method"`
	// Old is the old permission (for removed/modified).
	Old *Permission `json:"old,omitempty" yaml:"old,omitempty"`
	// New is the new permission (for added/modified).
	New *Permission `json:"new,omitempty" yaml:"new,omitempty"`
}

type PermissionSummary struct {
	ServiceCount int
	MethodCount  int
	PublicCount  int
	ByRole       map[string]int
	ByScope      map[string]int
}

type RateLimit struct {
	// Requests is the maximum number of requests.
	Requests int `json:"requests" yaml:"requests"`
	// Window is the time window (e.g., "1m", "1h").
	Window string `json:"window" yaml:"window"`
	// PerUser if true, rate limit is per user.
	PerUser bool `json:"per_user,omitempty" yaml:"per_user,omitempty"`
}

type ServicePermissions struct {
	// Service is the fully qualified service name.
	Service string `json:"service" yaml:"service"`
	// Resource is the resource name for this service.
	Resource string `json:"resource,omitempty" yaml:"resource,omitempty"`
	// DefaultRoles are default roles for all methods.
	DefaultRoles []string `json:"default_roles,omitempty" yaml:"default_roles,omitempty"`
	// Methods maps method names to permissions.
	Methods map[string]*Permission `json:"methods" yaml:"methods"`
}