authz

const (
	KindUser      PrincipalKind = "user"
	KindToken     PrincipalKind = "token"
	KindAnonymous PrincipalKind = "anonymous"
	KindSystem    PrincipalKind = "system"
)

const (
	// Install-scoped verbs. Held through a grant with no app (O-17), which is
	// what makes "an administrator" a principal with a grant rather than a
	// separate mechanism beside grants and roles.
	//
	// Namespaced `install.*` so the scope is visible at every call site: a verb
	// that reads `install.` cannot be mistaken for one that needs an app, which
	// is the mistake that would reintroduce the hole these close.
	InstallView           Verb = "install.view"
	InstallUsersManage    Verb = "install.users.manage"
	InstallPolicyManage   Verb = "install.policy.manage"
	InstallAdaptersManage Verb = "install.adapters.manage"
	InstallAuditRead      Verb = "install.audit.read"

	// InstallBackupManage covers taking, verifying and restoring backups.
	// Its own verb rather than part of install.policy.manage: a restore
	// replaces the entire install, and folding that into the verb that edits a
	// source allowlist would hand it to everyone who could edit one.
	InstallBackupManage Verb = "install.backup.manage"

	// The install.apps.* verbs are each app verb's install-wide counterpart:
	// install.apps.deploy is app.deploy on every app, including apps made
	// later (issue #81). They are how an install grant bears on an app — the
	// one sanctioned way, read in exactly one place, CheckControl, through the
	// table in everyApp. One verb per app verb rather than bundles, so a
	// custom role can carry "read every app's logs" without "deploy every
	// app", and so a group gets a permission once instead of a grant on each
	// app. The old bundles, install.apps.view as Viewer and
	// install.apps.manage as Owner on every app, are built-in roles now:
	// App viewer and App manager (R-081).
	//
	// Control plane only. None appears in CheckData: using an app still needs
	// a data grant or ownership (R-072, R-087).
	InstallAppsView              Verb = "install.apps.view"
	InstallAppsLogsRead          Verb = "install.apps.logs.read"
	InstallAppsDeploy            Verb = "install.apps.deploy"
	InstallAppsRestart           Verb = "install.apps.restart"
	InstallAppsSpecEdit          Verb = "install.apps.spec.edit"
	InstallAppsSecretsWrite      Verb = "install.apps.secrets.write"
	InstallAppsSecretsRead       Verb = "install.apps.secrets.read"
	InstallAppsExec              Verb = "install.apps.exec"
	InstallAppsGrantsManage      Verb = "install.apps.grants.manage"
	InstallAppsRoutingOverride   Verb = "install.apps.routing.override"
	InstallAppsResourcesOverride Verb = "install.apps.resources.override"
	InstallAppsEgressTighten     Verb = "install.apps.egress.tighten"
	InstallAppsEgressLoosen      Verb = "install.apps.egress.loosen"
	InstallAppsDelete            Verb = "install.apps.delete"

	// InstallTokensManage covers service tokens (R-060): listing, creating and
	// revoking them. Its own verb rather than install.users.manage's, because a
	// service token is a principal an automation acts as — issuing one is a
	// different trust from managing people, and an installation may want
	// somebody who runs its CI to hold one without the other.
	InstallTokensManage Verb = "install.tokens.manage"

	// InstallDeploysApprove approves or rejects any deploy that needs
	// approval, on any app, including the holder's own (R-155). It is
	// app.deploy.approve's install-wide counterpart, older than the
	// install.apps.* verbs and named for what it does rather than renamed to
	// match them. Not in App manager: approval is a trust an installation
	// hands out on purpose, and managing apps does not imply it.
	InstallDeploysApprove Verb = "install.deploys.approve"

	// InstallUpgrade upgrades Pando itself in place (R-356): it replaces the
	// server everything else runs behind, so it is its own trust rather than
	// part of managing policy or adapters.
	InstallUpgrade Verb = "install.upgrade"

	// InstallEventsManage subscribes to events install-wide and manages
	// anybody's subscriptions (R-368). An install-wide subscription hears about
	// every app and about sign-ins, which is why seeing one app is not enough.
	InstallEventsManage Verb = "install.events.manage"

	// InstallAuditExport sends the audit log off the installation: creating,
	// changing or removing an audit sink (R-385). Not part of
	// install.audit.read — an auditor reads the log where it is, and pointing
	// it somewhere new is a different thing to trust someone with.
	InstallAuditExport Verb = "install.audit.export"

	// AppCreate is install-scoped despite its name: there is no app yet when it
	// is checked. Sequence A step 1 has always called it install-level.
	AppCreate Verb = "app.create"

	AppView             Verb = "app.view"
	AppLogsRead         Verb = "app.logs.read"
	AppDeploy           Verb = "app.deploy"
	AppRestart          Verb = "app.restart"
	AppSpecEdit         Verb = "app.spec.edit"
	AppSecretsWrite     Verb = "app.secrets.write"
	AppSecretsRead      Verb = "app.secrets.read"
	AppExec             Verb = "app.exec"
	AppGrantsManage     Verb = "app.grants.manage"
	AppRoutingOverride  Verb = "app.routing.override"
	AppResourceOverride Verb = "app.resources.override"

	// AppEgressTighten changes an app's egress within the installation's
	// rules (R-182, R-184): its own list, additions to a denylist, removals
	// from an allowlist, private addresses blocked. Never beyond policy
	// (R-272), so Operator holds it as well as Owner.
	AppEgressTighten Verb = "app.egress.tighten"

	// AppEgressLoosen loosens the installation's egress rules for an app,
	// where host policy permits loosening by verb (R-183, R-184). It was
	// app.egress.override until issue #79; the migration renamed it in every
	// role that held it. Holding it covers every egress change, tightening
	// included.
	AppEgressLoosen Verb = "app.egress.loosen"

	// AppDeployApprove approves or rejects this app's deploys that need
	// approval (R-155). In no built-in role: an installation grants it
	// deliberately, through a custom role.
	AppDeployApprove Verb = "app.deploy.approve"

	AppDelete Verb = "app.delete"
)