# RBAC — admin feature permissions
#
# Covers: admin pages, admin API endpoints, service token management.
# Enable when using the admin panel feature.

let E = (import "../rbac-base.ncl").effects in

{
  admin = [
    { resource = "page",     pattern = "/admin/*",                             outcome = "allow", methods = [],       effects = E.audit_allow },
    { resource = "endpoint", pattern = "/api/admin/*",                         outcome = "allow", methods = [],       effects = E.audit_allow },
    { resource = "endpoint", pattern = "/api/server_list_service_tokens*",     outcome = "allow", methods = ["POST"], effects = [] },
    { resource = "endpoint", pattern = "/api/server_create_service_token*",    outcome = "allow", methods = ["POST"], effects = [] },
    { resource = "endpoint", pattern = "/api/server_revoke_service_token*",    outcome = "allow", methods = ["POST"], effects = [] },
  ],

  user = [
    # Explicitly deny admin endpoints for non-admin authenticated users
    { resource = "page",     pattern = "/admin/*",  outcome = "deny", methods = [], effects = E.audit_deny @ E.api_forbidden },
    { resource = "endpoint", pattern = "/api/admin/*", outcome = "deny", methods = [], effects = E.audit_deny @ E.api_forbidden },
  ],

  guest = [],
}