seeds

type Bundle struct {
	Permissions       []PermissionSeed       `yaml:"permissions"`
	Roles             []RoleSeed             `yaml:"roles"`
	ResourceTypes     []ResourceTypeSeed     `yaml:"resource_types"`
	RelationshipTypes []RelationshipTypeSeed `yaml:"relationship_types"`
}

type PermissionSeed struct {
	Key         string `yaml:"key"`
	Description string `yaml:"description"`
	Sensitive   bool   `yaml:"sensitive"`
	// GrantedVia declares the ReBAC rule fed into the authz registry.
	GrantedVia string `yaml:"granted_via"`
	// StepUp declares that this permission requires an elevated authentication
	// factor (MFA): an otherwise-allowed decision becomes a step-up challenge
	// when the actor's AMR carries no strong factor (roadmap S3). Propagated to
	// authz.Permission.StepUp at boot and persisted to permissions.step_up.
	StepUp bool `yaml:"step_up"`
	// StepUpAMR, when non-empty, narrows step-up to a SPECIFIC AMR subset for
	// this permission (e.g. ["hwk"] to require a hardware key specifically,
	// rather than any factor from the deployment's default strong-factor set).
	// Only meaningful alongside step_up: true (validated); propagated to
	// authz.Permission.StepUpPolicy.RequiredAMR at boot. NOT persisted —
	// permissions.step_up remains the plain bool; a richer per-permission AMR
	// policy is registry-declared (seed-driven, in-memory), not DB-persisted.
	// See kernel/seeds doc comment (package-level) and B8 backlog item for the
	// cheapest-correct-path rationale.
	StepUpAMR []string `yaml:"step_up_amr"`
	// StepUpChallenge, when set, is the factor/hint the HTTP gate advertises in
	// WWW-Authenticate for this permission's step-up challenge (e.g. "hwk"
	// alongside step_up_amr: [hwk]). Only meaningful alongside step_up: true.
	// Propagated to authz.Permission.StepUpPolicy.Challenge at boot. Not
	// persisted, same rationale as StepUpAMR.
	StepUpChallenge string `yaml:"step_up_challenge"`
}

type RelationshipTypeSeed struct {
	Key         string `yaml:"key"`
	SubjectKind string `yaml:"subject_kind"`
	ObjectKind  string `yaml:"object_kind"`
	Cardinality string `yaml:"cardinality"`
	Description string `yaml:"description"`
}

type ResourceTypeSeed struct {
	Key         string `yaml:"key"`
	Description string `yaml:"description"`
}

type RoleSeed struct {
	Key         string   `yaml:"key"`
	Name        string   `yaml:"name"`
	Permissions []string `yaml:"permissions"`
}

type SpineInvalidator interface{ InvalidateAll() }