# RBAC — content feature permissions
#
# Covers: content rendering and index endpoints.
# Enable when using rustelo_content.

let E = (import "../rbac-base.ncl").effects in

{
  admin = [
    { resource = "endpoint", pattern = "/api/content/*",        outcome = "allow", methods = ["GET", "POST", "PUT", "DELETE"], effects = E.audit_allow },
    { resource = "page",     pattern = "/admin/content/*",      outcome = "allow", methods = [], effects = [] },
  ],

  moderator = [
    { resource = "endpoint", pattern = "/api/content/*",        outcome = "allow", methods = ["GET", "POST", "PUT"], effects = E.audit_allow },
    { resource = "page",     pattern = "/admin/content/*",      outcome = "allow", methods = [], effects = [] },
  ],

  user = [
    { resource = "endpoint", pattern = "/api/content-render/*", outcome = "allow", methods = ["GET"], effects = [] },
    { resource = "endpoint", pattern = "/api/content-index/*",  outcome = "allow", methods = ["GET"], effects = [] },
  ],

  guest = [
    { resource = "endpoint", pattern = "/api/content-render/*", outcome = "allow", methods = ["GET"], effects = [] },
    { resource = "endpoint", pattern = "/api/content-index/*",  outcome = "allow", methods = ["GET"], effects = [] },
  ],
}