rbac

type InMemoryPermissionStore struct {
	// contains filtered or unexported fields
}

type InMemoryRoleStore struct {
	// contains filtered or unexported fields
}

type Permission struct {
	// Unique identifier for the permission
	ID string `json:"id"`

	// Human-readable name for the permission
	Name string `json:"name"`

	// Description of the permission
	Description string `json:"description"`

	// Resource type this permission applies to
	ResourceType string `json:"resource_type"`

	// Action this permission allows
	Action string `json:"action"`

	// Whether this is a system permission (cannot be deleted)
	SystemPermission bool `json:"system_permission"`

	// Time when the permission was created
	CreatedAt time.Time `json:"created_at"`

	// Time when the permission was last updated
	UpdatedAt time.Time `json:"updated_at"`

	// Additional metadata for the permission
	Metadata map[string]interface{} `json:"metadata,omitempty"`
}

type PermissionStore interface {
	// CreatePermission creates a new permission
	CreatePermission(ctx context.Context, permission *Permission) error

	// GetPermission retrieves a permission by ID
	GetPermission(ctx context.Context, permissionID string) (*Permission, error)

	// UpdatePermission updates an existing permission
	UpdatePermission(ctx context.Context, permission *Permission) error

	// DeletePermission deletes a permission
	DeletePermission(ctx context.Context, permissionID string) error

	// ListPermissions lists all permissions
	ListPermissions(ctx context.Context) ([]*Permission, error)

	// PermissionExists checks if a permission exists
	PermissionExists(ctx context.Context, permissionID string) (bool, error)

	// AssignPermissionToUser assigns a permission directly to a user
	AssignPermissionToUser(ctx context.Context, userID string, permissionID string) error

	// RevokePermissionFromUser revokes a permission from a user
	RevokePermissionFromUser(ctx context.Context, userID string, permissionID string) error

	// GetUserPermissions gets all permissions directly assigned to a user
	GetUserPermissions(ctx context.Context, userID string) ([]*Permission, error)
}

type RBACConfig struct {
	// Whether RBAC is enabled
	Enabled bool `json:"enabled"`

	// Whether to enforce strict role hierarchy
	StrictHierarchy bool `json:"strict_hierarchy"`

	// Whether to allow direct permission assignments to users
	AllowDirectPermissions bool `json:"allow_direct_permissions"`

	// Default roles to create
	DefaultRoles []Role `json:"default_roles"`

	// Maximum depth of role hierarchy
	MaxHierarchyDepth int `json:"max_hierarchy_depth"`

	// Whether to cache permission checks
	EnablePermissionCache bool `json:"enable_permission_cache"`

	// Permission cache TTL in seconds
	PermissionCacheTTL int `json:"permission_cache_ttl"`

	// Whether to automatically create missing permissions
	AutoCreatePermissions bool `json:"auto_create_permissions"`

	// Whether to log permission checks
	LogPermissionChecks bool `json:"log_permission_checks"`

	// Minimum severity for logging permission checks
	LogPermissionCheckSeverity common.AuditSeverity `json:"log_permission_check_severity"`
}

type RBACManager struct {
	// contains filtered or unexported fields
}

type Role struct {
	// Unique identifier for the role
	ID string `json:"id"`

	// Human-readable name for the role
	Name string `json:"name"`

	// Description of the role
	Description string `json:"description"`

	// Permissions assigned to this role
	Permissions []string `json:"permissions"`

	// Parent roles in the role hierarchy
	ParentRoles []string `json:"parent_roles"`

	// Whether the role is a system role (cannot be deleted)
	SystemRole bool `json:"system_role"`

	// Time when the role was created
	CreatedAt time.Time `json:"created_at"`

	// Time when the role was last updated
	UpdatedAt time.Time `json:"updated_at"`

	// Additional metadata for the role
	Metadata map[string]interface{} `json:"metadata,omitempty"`
}

type RoleStore interface {
	// CreateRole creates a new role
	CreateRole(ctx context.Context, role *Role) error

	// GetRole retrieves a role by ID
	GetRole(ctx context.Context, roleID string) (*Role, error)

	// UpdateRole updates an existing role
	UpdateRole(ctx context.Context, role *Role) error

	// DeleteRole deletes a role
	DeleteRole(ctx context.Context, roleID string) error

	// ListRoles lists all roles
	ListRoles(ctx context.Context) ([]*Role, error)

	// RoleExists checks if a role exists
	RoleExists(ctx context.Context, roleID string) (bool, error)

	// AssignRoleToUser assigns a role to a user
	AssignRoleToUser(ctx context.Context, userID string, roleID string) error

	// RevokeRoleFromUser revokes a role from a user
	RevokeRoleFromUser(ctx context.Context, userID string, roleID string) error

	// GetUserRoles gets all roles assigned to a user
	GetUserRoles(ctx context.Context, userID string) ([]*Role, error)

	// AddPermissionToRole adds a permission to a role
	AddPermissionToRole(ctx context.Context, roleID string, permissionID string) error

	// RemovePermissionFromRole removes a permission from a role
	RemovePermissionFromRole(ctx context.Context, roleID string, permissionID string) error
}

type UserPermission struct {
	// User ID
	UserID string `json:"user_id"`

	// Permission ID
	PermissionID string `json:"permission_id"`

	// Time when the permission was assigned
	AssignedAt time.Time `json:"assigned_at"`

	// User who assigned the permission
	AssignedBy string `json:"assigned_by,omitempty"`

	// Expiration time for the permission assignment (if any)
	ExpiresAt time.Time `json:"expires_at,omitempty"`
}

type UserRole struct {
	// User ID
	UserID string `json:"user_id"`

	// Role ID
	RoleID string `json:"role_id"`

	// Time when the role was assigned
	AssignedAt time.Time `json:"assigned_at"`

	// User who assigned the role
	AssignedBy string `json:"assigned_by,omitempty"`

	// Expiration time for the role assignment (if any)
	ExpiresAt time.Time `json:"expires_at,omitempty"`
}