# RBAC — auth feature permissions
#
# Covers: OTP login flow, session management, account management.
# Enable when using rustelo_auth.
#
# Each field is an array of permission entries for that role.
# Concatenate with @ in your site/rbac.ncl:
#   permissions = auth.admin @ other_feature.admin

let E = (import "../rbac-base.ncl").effects in

{
  admin = [],  # admin inherits all via wildcard — no specific auth rules needed

  user = [
    { resource = "endpoint", pattern = "/api/server_logout*",              outcome = "allow", methods = ["POST"], effects = [] },
    { resource = "endpoint", pattern = "/api/server_logout_all*",          outcome = "allow", methods = ["POST"], effects = [] },
    { resource = "endpoint", pattern = "/api/server_refresh_token*",       outcome = "allow", methods = ["POST"], effects = [] },
    { resource = "endpoint", pattern = "/api/server_get_session_user*",    outcome = "allow", methods = ["POST"], effects = [] },
    { resource = "endpoint", pattern = "/api/server_update_display_name*", outcome = "allow", methods = ["POST"], effects = [] },
    { resource = "endpoint", pattern = "/api/server_delete_account*",      outcome = "allow", methods = ["POST"], effects = [] },
  ],

  guest = [
    { resource = "page",     pattern = "/login",                          outcome = "allow", methods = [], effects = [] },
    { resource = "page",     pattern = "/register",                       outcome = "allow", methods = [], effects = [] },
    { resource = "endpoint", pattern = "/api/auth/*",                     outcome = "allow", methods = [], effects = [] },
    { resource = "endpoint", pattern = "/api/server_request_otp*",        outcome = "allow", methods = ["POST"], effects = [] },
    { resource = "endpoint", pattern = "/api/server_verify_otp*",         outcome = "allow", methods = ["POST"], effects = [] },
    { resource = "endpoint", pattern = "/api/server_accept_gdpr*",        outcome = "allow", methods = ["POST"], effects = [] },
    { resource = "endpoint", pattern = "/api/server_get_session_user*",   outcome = "allow", methods = ["POST"], effects = [] },
  ],
}