rbac

type Permission struct {
	ID       string `json:"id"`
	RoleID   string `json:"role_id"`
	Action   string `json:"action"`   // e.g. "read", "write", "delete", "admin"
	Resource string `json:"resource"` // e.g. "user", "org", "document"
}

type Role struct {
	ID          string    `json:"id"`
	AppID       string    `json:"app_id"`
	EnvID       string    `json:"env_id"`
	ParentID    string    `json:"parent_id,omitempty"` // Empty = root role (no parent)
	Name        string    `json:"name"`
	Slug        string    `json:"slug"`
	Description string    `json:"description,omitempty"`
	CreatedAt   time.Time `json:"created_at"`
	UpdatedAt   time.Time `json:"updated_at"`

	// NamespacePath is the warden namespace the role was read from. Warden
	// resolves ParentID (a slug) in this namespace only. It is read-only:
	// ToWardenRole places a role by EnvID, not by this field.
	NamespacePath string `json:"-"`
}

type Store interface {
	// Role CRUD
	CreateRole(ctx context.Context, r *Role) error
	GetRole(ctx context.Context, appID, roleID string) (*Role, error)
	// GetRoles loads several roles in one call; ids that do not resolve
	// are left out rather than failing the whole call.
	GetRoles(ctx context.Context, appID string, roleIDs []string) ([]*Role, error)
	GetRoleBySlug(ctx context.Context, appID string, slug string) (*Role, error)
	UpdateRole(ctx context.Context, r *Role) error
	DeleteRole(ctx context.Context, appID, roleID string) error
	ListRoles(ctx context.Context, appID string) ([]*Role, error)

	// Permission management
	AddPermission(ctx context.Context, appID string, p *Permission) error
	RemovePermission(ctx context.Context, appID, permID string) error
	ListRolePermissions(ctx context.Context, appID, roleID string) ([]*Permission, error)

	// Role assignment
	AssignUserRole(ctx context.Context, appID string, ur *UserRole) error
	UnassignUserRole(ctx context.Context, appID, userID, roleID string) error
	ListUserRoles(ctx context.Context, userID string) ([]*Role, error)
	ListUserRolesForApp(ctx context.Context, appID string, userID string) ([]*Role, error)

	// Hierarchy
	GetRoleChildren(ctx context.Context, appID, roleID string) ([]*Role, error)

	// Permission check — walks the parent chain for inherited permissions.
	HasPermission(ctx context.Context, userID string, action, resource string) (bool, error)
}

type UserRole struct {
	UserID     string    `json:"user_id"`
	RoleID     string    `json:"role_id"`
	OrgID      string    `json:"org_id,omitempty"` // empty = global scope
	AssignedAt time.Time `json:"assigned_at"`
}

type WardenStore struct {
	// contains filtered or unexported fields
}