delegation

type ActionValidation struct {
	Allowed      bool   `json:"allowed"`
	Reason       string `json:"reason,omitempty"`
	Confirmation bool   `json:"confirmation_required"`
}

type Chain struct {
	// Links ordered from root (human/service) to current (typically agent)
	Links []Link `json:"links"`
	// Effective constraints computed by intersecting all links
	EffectiveConstraints Constraints `json:"effective_constraints"`
}

type Constraints struct {
	// AllowedCapabilities lists capabilities the delegate can use.
	// Empty means all capabilities of the parent are available.
	AllowedCapabilities []string `json:"allowed_capabilities,omitempty"`

	// AllowedScopes lists scopes the delegate can request.
	// Empty means all scopes of the parent are available.
	AllowedScopes []string `json:"allowed_scopes,omitempty"`

	// AllowedResources lists resource patterns the delegate can access.
	// Supports glob patterns like "project/*" or "org/123/*"
	AllowedResources []string `json:"allowed_resources,omitempty"`

	// AllowedActions lists actions the delegate can perform.
	// Example: ["read", "write"], ["*"]
	AllowedActions []string `json:"allowed_actions,omitempty"`

	// MaxTokenLifetime limits token duration for the delegate.
	MaxTokenLifetime time.Duration `json:"max_token_lifetime,omitempty"`

	// RequiresConfirmation indicates actions need human approval.
	RequiresConfirmation bool `json:"requires_confirmation"`

	// ExpiresAt is when the delegation expires.
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
}

type CreateInput struct {
	// DelegatorID is the principal granting the delegation.
	DelegatorID uuid.UUID

	// DelegateID is the principal receiving the delegation.
	DelegateID uuid.UUID

	// Constraints on what the delegate can do.
	Constraints Constraints

	// Reason for the delegation (audit).
	Reason string
}

type DefaultService struct {
	// contains filtered or unexported fields
}

type Link struct {
	PrincipalID   uuid.UUID      `json:"principal_id"`
	PrincipalType principal.Type `json:"principal_type"`
	DisplayName   string         `json:"display_name"`
	Constraints   Constraints    `json:"constraints"`
	GrantedAt     time.Time      `json:"granted_at"`
	// Active reports whether the principal is active; a chain with an
	// inactive principal authorizes nothing.
	Active bool `json:"active"`
}

type Service interface {
	// CreateDelegation creates a delegation from one principal to another.
	CreateDelegation(ctx context.Context, input CreateInput) (*Link, error)

	// GetChain retrieves the full delegation chain for a principal.
	GetChain(ctx context.Context, principalID uuid.UUID) (*Chain, error)

	// ValidateAction checks if a principal can perform an action on a resource.
	ValidateAction(ctx context.Context, principalID uuid.UUID, action, resource string) (*ActionValidation, error)

	// RevokeDelegation revokes a delegation.
	RevokeDelegation(ctx context.Context, delegatorID, delegateID uuid.UUID, reason string) error

	// ListDelegations lists all delegations granted by a principal.
	ListDelegations(ctx context.Context, delegatorID uuid.UUID) ([]*Link, error)

	// ComputeEffectiveConstraints computes the effective constraints
	// by intersecting constraints through the delegation chain.
	ComputeEffectiveConstraints(chain *Chain) Constraints
}