authz

type Authorizer interface {
	// Authorize performs an authorization check.
	//
	// The implementation should:
	// 1. Extract subjects (roles/username) from the token
	// 2. Apply the appropriate authorization model based on configuration
	// 3. For v2: Use ResourceContext dimensions if available
	// 4. Return an error only for system failures, not for denied access
	//
	// Thread-safety: This method may be called concurrently from multiple goroutines.
	Authorize(ctx context.Context, req *Request) (*Decision, error)

	// Version returns the authorization model version this authorizer implements.
	// Returns "v1" for legacy path-based, "v2" for RPC+dimensions, etc.
	Version() string

	// SupportsResourceAuthorization returns true if this authorizer
	// supports resource-level authorization with dimensions.
	// If false, ResourceContext will always be ignored.
	SupportsResourceAuthorization() bool
}

type CasbinV1Config struct {
	PolicyConfig

	// RoleProvider extracts role/group subjects.
	RoleProvider platformauthz.RoleProvider

	// Adapter is a custom policy adapter (e.g., SQL).
	// If nil, uses string adapter with Csv content.
	Adapter persist.Adapter
}

type CasbinV2Config struct {
	PolicyConfig

	// RoleProvider extracts role/group subjects.
	RoleProvider platformauthz.RoleProvider

	// Adapter is a custom policy adapter (e.g., SQL).
	// If nil, uses string adapter with Csv content.
	Adapter persist.Adapter
}

type CedarConfig struct {
	PolicyConfig

	// RoleProvider extracts role/group subjects.
	RoleProvider platformauthz.RoleProvider

	// SchemaPath is the path to the Cedar schema file.
	SchemaPath string

	// PoliciesPath is the path to Cedar policy files.
	PoliciesPath string

	// EntitiesPath is the path to Cedar entities file.
	EntitiesPath string
}

type Config struct {
	// Policy configuration (claims, CSV, adapter, etc.)
	PolicyConfig

	// Logger for authorization decisions
	Logger any

	// Options for engine-specific configuration
	Options []Option
}

type Decision struct {
	// Allowed indicates whether the request is permitted.
	Allowed bool

	// Reason provides a human-readable explanation for audit logging.
	Reason string

	// Mode indicates which authorization model was used.
	Mode Mode

	// MatchedPolicy optionally contains the policy rule that matched (for debugging).
	MatchedPolicy string

	// Metadata contains supplemental information for audit logging.
	Metadata DecisionMetadata
}

type DecisionMetadata struct {
	// GroupsClaim is the configured JWT claim used to extract authorization groups.
	GroupsClaim string
}

type EnforcementResult struct {
	// Allowed indicates whether the request is permitted.
	Allowed bool

	// GroupsClaim is the configured JWT claim used to extract authorization groups.
	GroupsClaim string
}

type EngineType string

type Factory func(cfg Config) (Authorizer, error)

type JWTClaimsRoleProvider struct {
	// contains filtered or unexported fields
}

type Mode string

type OPAConfig struct {
	PolicyConfig

	// RoleProvider extracts role/group subjects.
	RoleProvider platformauthz.RoleProvider

	// BundlePath is the path to the OPA bundle.
	BundlePath string

	// Query is the Rego query for authorization decisions.
	Query string
}

type Option func(*optionConfig)

type PolicyConfig struct {
	Builtin string `mapstructure:"-" json:"-"`

	// Issuer is the configured token issuer for role provider requests.
	Issuer string `mapstructure:"-" json:"-"`

	// Engine specifies the authorization engine to use.
	// - "casbin" (default): Casbin policy engine
	// - "cedar": AWS Cedar policy engine (future)
	// - "opa": Open Policy Agent engine (future)
	Engine string `mapstructure:"engine" json:"engine" default:"casbin"`

	// Version specifies the engine-specific authorization model version.
	// For Casbin:
	// - "v1" (default): Legacy path-based authorization (subject, resource, action)
	// - "v2": RPC + dimensions authorization (subject, rpc, dimensions)
	// v2 enables fine-grained resource-level authorization using AuthzResolvers.
	Version string `mapstructure:"version" json:"version" default:"v1"`

	// Username claim to use for user information
	UserNameClaim string `mapstructure:"username_claim" json:"username_claim" default:"preferred_username"`

	// Claim to use for group/role information
	GroupsClaim string `mapstructure:"groups_claim" json:"groups_claim" default:"realm_access.roles"`

	// Role provider configuration (resolved via StartOptions)
	RolesProvider RolesProviderConfig `mapstructure:"roles_provider" json:"roles_provider"`

	// Claim to use to reference idP clientID
	ClientIDClaim string `mapstructure:"client_id_claim" json:"client_id_claim" default:"azp"`

	// Deprecated: Use GroupsClaim instead
	RoleClaim string `mapstructure:"claim" json:"claim" default:"realm_access.roles"`

	// Deprecated: Use Casbin grouping statements g, <user/group>, <role>
	RoleMap map[string]string `mapstructure:"map" json:"map"`

	// Override the builtin policy with a custom policy
	Csv string `mapstructure:"csv" json:"csv"`

	// Extend the builtin policy with a custom policy
	Extension string `mapstructure:"extension" json:"extension"`

	Model string `mapstructure:"model" json:"model"`

	// Adapter is intentionally any to allow future adapter config shapes beyond Casbin persist.Adapter.
	// Conversion and validation happen downstream.
	Adapter any `mapstructure:"-" json:"-"`
}

type Request struct {
	// Subject information extracted from JWT
	Token jwt.Token

	// RPC method path (e.g., "/policy.attributes.AttributesService/UpdateAttribute")
	// Used as the primary resource identifier in v2 model.
	RPC string

	// Action derived from RPC method (read, write, delete, unsafe).
	// Used in v1 model; informational in v2 model.
	Action string

	// ResourceContext contains resolved authorization dimensions (namespace, attribute, etc.).
	// If non-nil, indicates resource-level authorization should be attempted.
	// Populated by ResolverRegistry when a resolver is registered for the RPC.
	ResourceContext *ResolverContext
}

type ResolverContext struct {
	Resources []*ResolverResource

	// ResolvedData stores data fetched during resolution (e.g., attributes, namespaces)
	// to avoid duplicate DB queries in handlers. Keys are service-defined strings.
	// Handlers can retrieve this data via GetResolvedDataFromContext().
	ResolvedData map[string]any
}

type ResolverFunc func(ctx context.Context, req connect.AnyRequest) (ResolverContext, error)

type ResolverRegistry struct {
	// contains filtered or unexported fields
}

type ResolverResource map[string]string

type RolesProviderConfig struct {
	Name   string         `mapstructure:"name" json:"name"`
	Config map[string]any `mapstructure:"config" json:"config"`
}

type ScopedResolverRegistry struct {
	// contains filtered or unexported fields
}

type SubjectExtractor struct {
	// contains filtered or unexported fields
}