authorization

type ACLRegistry interface {
	// GetAccessLevel returns the access level for a pubkey and remote address.
	GetAccessLevel(pub []byte, address string) string
	// CheckPolicy checks if an event passes ACL policy.
	CheckPolicy(ev *event.E) (bool, error)
	// Active returns the active ACL mode name.
	Active() string
}

type Authorizer interface {
	// Authorize checks if event is allowed based on ACL and policy.
	Authorize(ev *event.E, authedPubkey []byte, remote string, eventKind uint16) Decision
}

type Config struct {
	AuthRequired bool     // Whether auth is required for all operations
	AuthToWrite  bool     // Whether auth is required for write operations
	Admins       [][]byte // Admin pubkeys
	Owners       [][]byte // Owner pubkeys
}

type Decision struct {
	Allowed      bool
	AccessLevel  string // none/read/write/admin/owner/blocked/banned
	IsAdmin      bool
	IsOwner      bool
	IsPeerRelay  bool
	SkipACLCheck bool   // For admin/owner deletes
	DenyReason   string // Human-readable reason for denial
	RequireAuth  bool   // Should send AUTH challenge
}

type PolicyManager interface {
	// IsEnabled returns whether policy is enabled.
	IsEnabled() bool
	// CheckPolicy checks if an action is allowed by policy.
	CheckPolicy(action string, ev *event.E, pubkey []byte, remote string) (bool, error)
}

type Service struct {
	// contains filtered or unexported fields
}

type SyncManager interface {
	// GetPeers returns the list of peer relay URLs.
	GetPeers() []string
	// IsAuthorizedPeer checks if a pubkey is an authorized peer.
	IsAuthorizedPeer(url, pubkey string) bool
}