# RBAC Base — role skeleton and shared effects
#
# Provides the common effect dictionary and the default fallback policy.
# Feature fragments (features/*.ncl) provide permissions per role.
# Compose in your site/rbac.ncl using the @ array concatenation operator.
#
# Usage:
#   let base    = import "rustelo/resources/nickel/rbac/rbac-base.ncl" in
#   let auth    = import "rustelo/resources/nickel/rbac/features/auth.ncl" in
#   let content = import "rustelo/resources/nickel/rbac/features/content.ncl" in
#
#   { groups = [
#       { name = "admin", ..., permissions = auth.admin @ content.admin },
#       { name = "user",  ..., permissions = auth.user  @ content.user  },
#       { name = "guest", ..., permissions = auth.guest @ content.guest },
#     ],
#     defaults = base.defaults & { unauthenticated_allow = [ ...site-specific... ] },
#   } | C.FileRbacConfig | RoleNamesConsistent

{
  # Reusable effect sets — import and reference as E.redirect_login, etc.
  effects = {
    redirect_login = [{ type = "redirect", to = "/login?return={request.path}" }],
    audit_deny     = [{ type = "audit_log", event = "access_denied",  level = "warn" }],
    audit_allow    = [{ type = "audit_log", event = "access_granted", level = "info" }],
    api_forbidden  = [{ type = "response", status = 403, body.error = "Forbidden" }],
    log_warn       = [{ type = "log", level = "warn", message = "Denied: {request.path}" }],
    security_alert = [{
      type    = "notify",
      channel = "security",
      message = "Access: {request.path} by {user.email}",
    }],
  },

  # Minimal defaults — override unauthenticated_allow in your site/rbac.ncl
  defaults = {
    unauthenticated_allow    = [],
    unauthenticated_deny     = [],
    authenticated_fallback   = "deny",
    unauthenticated_fallback = "deny",
    fallback_effects         = [{ type = "log", level = "warn", message = "Denied: {request.path}" }],
  },
}