authz

var (
	ErrInvalidRequest        = errors.New("invalid request")
	ErrEmptyRequest          = errors.New("empty request")
	ErrAuthorizationDecision = errors.New("authorization decision error")
	ErrAuthorizationDenied   = errors.New("authorization denied")
	ErrWrongTenantID         = errors.New("wrong tenant ID in request")

	ErrExtractClientData  = errors.New("error extracting client data from context")
	ErrCreateAuthzRequest = errors.New("error creating authorization request")
	ErrExtractTenantID    = errors.New("error extracting tenant ID from context")
	ErrAuthzDecision      = errors.New("error making authorization decision")
)

var (
	ErrValidation                  = errors.New("validation failed")
	ErrUserEmpty                   = errors.New("user is empty")
	ErrActionInvalid               = errors.New("action is invalid")
	ErrResourceTypeInvalid         = errors.New("resource type is invalid")
	ErrResourceTypeOrActionInvalid = errors.New("resource type or action is invalid")
)

var (
	RestrictionsByOperation = make(map[Operation]Restricted)
	RestrictionsByAPI       = make(map[string]Restricted)
	AllowListByAPI          = make(map[string]Allowed)
)

var ActionResourceTypes map[Action]ResourceTypeName

var ErrInvalidRole = errors.New("invalid role")

var InfoAuthorizationPassed = "Authorization check passed"

var PolicyData = policies{
	Roles: []constants.Role{
		constants.KeyAdminRole, constants.TenantAdminRole, constants.TenantAuditorRole,
	},
	Policies: []Policy{
		{
			ID:   "AuditorPolicy",
			Role: constants.TenantAuditorRole,
			ResourceTypes: []ResourceType{
				{
					ID: ResourceTypeKeyConfiguration,
					Actions: []Action{
						ActionRead,
					},
				},
				{
					ID: ResourceTypeKey,
					Actions: []Action{
						ActionRead,
					},
				},
				{
					ID: ResourceTypeSystem,
					Actions: []Action{
						ActionRead,
					},
				},
				{
					ID: ResourceTypeWorkFlow,
					Actions: []Action{
						ActionRead,
					},
				},
				{
					ID: ResourceTypeUserGroup,
					Actions: []Action{
						ActionRead,
					},
				},
				{
					ID: ResourceTypeTenant,
					Actions: []Action{
						ActionRead,
					},
				},
			},
		},
		{
			ID:   "KeyAdminPolicy",
			Role: constants.KeyAdminRole,
			ResourceTypes: []ResourceType{
				{
					ID: ResourceTypeKeyConfiguration,
					Actions: []Action{
						ActionRead,
						ActionCreate,
						ActionDelete,
						ActionUpdate,
					},
				},
				{
					ID: ResourceTypeKey,
					Actions: []Action{
						ActionRead,
						ActionCreate,
						ActionDelete,
						ActionUpdate,
						ActionKeyRotate,
					},
				},
				{
					ID: ResourceTypeUserGroup,
					Actions: []Action{
						ActionRead,
					},
				},
				{
					ID: ResourceTypeSystem,
					Actions: []Action{
						ActionSystemModifyLink,
						ActionRead,
						ActionUpdate,
					},
				},
				{
					ID: ResourceTypeWorkFlow,
					Actions: []Action{
						ActionRead,
						ActionCreate,
						ActionDelete,
						ActionUpdate,
					},
				},
			},
		},
		{
			ID:   "TenantAdminPolicy",
			Role: constants.TenantAdminRole,
			ResourceTypes: []ResourceType{
				{
					ID: ResourceTypeTenant,
					Actions: []Action{
						ActionRead,
						ActionUpdate,
					},
				},
				{
					ID: ResourceTypeUserGroup,
					Actions: []Action{
						ActionRead,
						ActionCreate,
						ActionDelete,
						ActionUpdate,
					},
				},
			},
		},
	},
}

var ResourceTypeActions = map[ResourceTypeName]map[Action]struct{}{
	ResourceTypeKeyConfiguration: {
		ActionRead:   {},
		ActionCreate: {},
		ActionDelete: {},
		ActionUpdate: {},
	},
	ResourceTypeKey: {
		ActionRead:      {},
		ActionCreate:    {},
		ActionDelete:    {},
		ActionUpdate:    {},
		ActionKeyRotate: {},
	},
	ResourceTypeSystem: {
		ActionRead:             {},
		ActionSystemModifyLink: {},
	},
	ResourceTypeWorkFlow: {
		ActionRead:   {},
		ActionCreate: {},
		ActionDelete: {},
		ActionUpdate: {},
	},
	ResourceTypeUserGroup: {
		ActionRead:   {},
		ActionCreate: {},
		ActionDelete: {},
		ActionUpdate: {},
	},
	ResourceTypeTenant: {
		ActionRead:   {},
		ActionUpdate: {},
	},
}

var RolePolicies = make(map[constants.Role][]Policy)

var ValidRoles = make(map[constants.Role]struct{})