personacfg

type APIRouteDef struct {
	// Connection is a glob matched against the connection name.
	Connection string `yaml:"connection"`
	// Methods are HTTP method globs. Empty matches any method.
	Methods []string `yaml:"methods,omitempty"`
	// Paths are path globs, matched against both the path a call reaches and
	// the catalog template it resolved from. Empty matches any path.
	Paths []string `yaml:"paths,omitempty"`
	// Action is "allow" (the default) or "deny". Deny wins.
	Action string `yaml:"action,omitempty"`
}

type ConnectionRulesDef struct {
	Allow []string `yaml:"allow,omitempty"`
	Deny  []string `yaml:"deny,omitempty"`
}

type ContextDef struct {
	DescriptionPrefix         string `yaml:"description_prefix,omitempty"`
	DescriptionOverride       string `yaml:"description_override,omitempty"`
	AgentInstructionsSuffix   string `yaml:"agent_instructions_suffix,omitempty"`
	AgentInstructionsOverride string `yaml:"agent_instructions_override,omitempty"`
}

type PersonaDef struct {
	DisplayName string             `yaml:"display_name"`
	Description string             `yaml:"description,omitempty"`
	Roles       []string           `yaml:"roles"`
	Tools       ToolRulesDef       `yaml:"tools"`
	Connections ConnectionRulesDef `yaml:"connections"`
	// APIRoutes narrows which HTTP methods and paths this persona may
	// invoke on api-kind connections it already reaches. Optional: a
	// connection no rule names keeps the connection-level decision as its
	// only gate.
	APIRoutes []APIRouteDef `yaml:"api_routes,omitempty"`
	Context   ContextDef    `yaml:"context"`
	Priority  int           `yaml:"priority,omitempty"`
}

type PersonasConfig struct {
	Definitions map[string]PersonaDef `yaml:",inline"`
	// DefaultPersona is no longer honored: a caller whose roles match no
	// persona has no access. The field is still parsed so Validate can reject a
	// config that sets it, and — because Definitions is an inline map — so that
	// `default_persona: analyst` does not decode as a persona *named*
	// "default_persona".
	DefaultPersona string            `yaml:"default_persona"`
	RoleMapping    RoleMappingConfig `yaml:"role_mapping"`
}

type RoleMappingConfig struct {
	OIDCToPersona map[string]string `yaml:"oidc_to_persona"`
}

type ToolRulesDef struct {
	Allow []string `yaml:"allow"`
	Deny  []string `yaml:"deny"`
}