syntax = "proto3";

package nexuscrm.runtime.v1;

import "common/v1/common.proto";

option go_package = "github.com/pingcap-inc/nexuscrm-contract/wire-go/gen/runtime/v1;runtimev1";

// EffectivePermissionService returns one complete or explicitly selected
// caller-effective permission projection. Product wire names and permission
// administration stay in L1.
service EffectivePermissionService {
  rpc ReadEffectivePermissions(ReadEffectivePermissionsRequest) returns (ReadEffectivePermissionsResponse);
}

// Identity and authority are authenticated transport context. An optional
// target principal is only a requested subject; Runtime authorizes disclosure.
message ReadEffectivePermissionsRequest {
  string target_principal_id = 1;
  optional uint64 min_catalog_revision = 2;
  EffectivePermissionSelection selection = 3;
}

enum EffectivePermissionSection {
  EFFECTIVE_PERMISSION_SECTION_UNSPECIFIED = 0;
  EFFECTIVE_PERMISSION_SECTION_SYSTEM_PERMISSIONS = 1;
  EFFECTIVE_PERMISSION_SECTION_CUSTOM_PERMISSIONS = 2;
  EFFECTIVE_PERMISSION_SECTION_OBJECT_PERMISSIONS = 3;
  EFFECTIVE_PERMISSION_SECTION_FIELD_PERMISSIONS = 4;
  EFFECTIVE_PERMISSION_SECTION_APPLICATION_PERMISSIONS = 5;
  EFFECTIVE_PERMISSION_SECTION_NAVIGATION_PERMISSIONS = 6;
  EFFECTIVE_PERMISSION_SECTION_RECORD_TYPE_PERMISSIONS = 7;
}

// Resource types scope only object, field and record-type sections. All values
// are neutral immutable Catalog identities; product-specific UI selection stays
// above this wire boundary.
message EffectivePermissionSelection {
  repeated EffectivePermissionSection sections = 1;
  repeated string resource_types = 2;
}

message EffectivePermissionGrant {
  string permission_id = 1;
  bool granted = 2;
}

// One Catalog resource-type authorization projection. These are neutral
// record-engine operations; public dialect permission names stay in L1.
message EffectiveObjectPermission {
  string resource_type = 1;
  bool can_read = 2;
  bool can_create = 3;
  bool can_edit = 4;
  bool can_delete = 5;
  bool can_deactivate = 6;
  bool can_view_all = 7;
  bool can_modify_all = 8;
}

message EffectiveFieldPermission {
  // Resolved insert capability; never derive it from can_edit.
  bool can_create = 5;
  string resource_type = 1;
  string field_name = 2;
  bool can_read = 3;
  bool can_edit = 4;
}

message EffectiveApplicationPermission {
  string application_id = 1;
  bool can_view = 2;
  bool is_default = 3;
}

message EffectiveNavigationPermission {
  string navigation_key = 1;
  bool can_view = 2;
}

// One caller-effective availability decision for an active neutral Catalog
// record type. Public-dialect record-type shapes remain an L1 concern.
message EffectiveRecordTypePermission {
  string resource_type = 1;
  string record_type_id = 2;
  bool available = 5;
  bool is_default = 7;

  reserved 3, 4, 6;

  reserved "developer_name", "name", "master";
}

message ReadEffectivePermissionsResponse {
  // Permission identifiers defined by the platform permission catalog.
  repeated EffectivePermissionGrant system_permissions = 1;
  // Permission identifiers authored through the generic metadata extension.
  repeated EffectivePermissionGrant custom_permissions = 2;
  repeated EffectiveObjectPermission object_permissions = 3;
  repeated EffectiveFieldPermission field_permissions = 4;
  nexuscrm.common.v1.ConsistencyReceipts receipts = 5;
  repeated EffectiveApplicationPermission application_permissions = 6;
  repeated EffectiveNavigationPermission navigation_permissions = 7;
  repeated EffectiveRecordTypePermission record_type_permissions = 8;
}