auth

const (
	// ActionKVRead is the Cedar action for a KV get/list (ADR-0074).
	ActionKVRead Action = "kv::read"
	// ActionKVWrite is the Cedar action for a KV put/delete (ADR-0074).
	ActionKVWrite Action = "kv::write"
	// ActionLinkInvoke is the Cedar action for a synchronous fn→fn invoke (ADR-0075):
	// principal = the caller Function, resource = the target Function.
	ActionLinkInvoke Action = "link::invoke"
	// ActionS3Read is the Cedar action for an S3 get/list/head over the blob substrate (ADR-0080):
	// a declared spec.blob binding grants it (binding-as-read-grant). Resource = a BlobPrefix.
	ActionS3Read Action = "s3::read"
	// ActionS3Write is the Cedar action for an S3 put/delete over the blob substrate (ADR-0080):
	// single-writer — permitted only when the principal IS the prefix owner. Resource = a BlobPrefix.
	ActionS3Write Action = "s3::write"
	// ActionEgressConnect is the Cedar action for an outbound worker connection (ADR-0117, F81):
	// principal = the caller Function (source-IP resolved), resource = a NetDestination. Default-deny —
	// a grant comes only from a compiled EgressPolicy; no built-in permit.
	ActionEgressConnect Action = "egress::connect"
	// ActionCatalogQuery is the Cedar action for a catalog SQL query over the Quack/DuckLake serving
	// path (ADR-0137, F102): a declared spec.catalogs binding grants it (binding-as-query-grant), and a
	// Catalog-scoped RolesAssignment grants it to an external Identity. Resource = a CatalogService.
	// Read-shaped (a Cedar permit, never a writers entry). The catalog PEP proxy is the enforcement point.
	ActionCatalogQuery Action = "catalog::query"
)

const (
	// RoleAdmin is cluster-wide: every verb in every namespace + cluster-scoped kinds.
	RoleAdmin Role = "admin"
	// RoleDeveloper may read+write within its bound namespaces.
	RoleDeveloper Role = "developer"
	// RoleViewer may only read within its bound namespaces.
	RoleViewer Role = "viewer"
)

const (
	VerbGet    Verb = "get"
	VerbList   Verb = "list"
	VerbCreate Verb = "create"
	VerbUpdate Verb = "update"
	VerbDelete Verb = "delete"
)