// @bun
// src/components/docs/safety/SafetyPDPPage.tsx
import Link from "@contractspec/lib.ui-link";
import { ChevronRight } from "lucide-react";
import { jsx, jsxs } from "react/jsx-runtime";
function SafetyPDPPage() {
  return /* @__PURE__ */ jsxs("div", {
    className: "space-y-8",
    children: [
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h1", {
            className: "text-4xl font-bold",
            children: "Policy Decision Points"
          }),
          /* @__PURE__ */ jsxs("p", {
            className: "text-muted-foreground",
            children: [
              "A ",
              /* @__PURE__ */ jsx("strong", {
                children: "Policy Decision Point (PDP)"
              }),
              " is a centralized component that evaluates access control policies and makes authorization decisions. According to",
              " ",
              /* @__PURE__ */ jsx("a", {
                href: "https://www.strongdm.com/blog/policy-decision-point",
                target: "_blank",
                rel: "noopener noreferrer",
                className: "text-violet-400 hover:text-violet-300",
                children: "StrongDM"
              }),
              ', the PDP "receives requests for access to resources, evaluates them against policies, and returns a decision (permit or deny)."'
            ]
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "How the PDP works in ContractSpec"
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "In ContractSpec, the PDP is invoked on every operation\u2014whether it's rendering a UI component, executing a capability, or querying a data view. The flow is:"
          }),
          /* @__PURE__ */ jsxs("ol", {
            className: "text-muted-foreground list-inside list-decimal space-y-3",
            children: [
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Request evaluation"
                  }),
                  " \u2013 The runtime sends a request to the PDP containing:",
                  /* @__PURE__ */ jsxs("ul", {
                    className: "mt-2 ml-6 list-inside list-disc space-y-1",
                    children: [
                      /* @__PURE__ */ jsx("li", {
                        children: "The user's identity and attributes (roles, groups, location, etc.)"
                      }),
                      /* @__PURE__ */ jsx("li", {
                        children: "The resource being accessed (capability, field, workflow step)"
                      }),
                      /* @__PURE__ */ jsx("li", {
                        children: "The action being performed (read, write, execute)"
                      }),
                      /* @__PURE__ */ jsx("li", {
                        children: "Contextual information (time of day, device type, IP address)"
                      })
                    ]
                  })
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Policy evaluation"
                  }),
                  " \u2013 The PDP evaluates the request against all applicable ",
                  /* @__PURE__ */ jsx("strong", {
                    children: "PolicySpecs"
                  }),
                  ". These specs define rules using attribute-based access control (ABAC) and can reference:",
                  /* @__PURE__ */ jsxs("ul", {
                    className: "mt-2 ml-6 list-inside list-disc space-y-1",
                    children: [
                      /* @__PURE__ */ jsx("li", {
                        children: `User attributes (e.g., "role == 'admin'")`
                      }),
                      /* @__PURE__ */ jsx("li", {
                        children: `Resource attributes (e.g., "field.sensitivity == 'PII'")`
                      }),
                      /* @__PURE__ */ jsx("li", {
                        children: 'Environmental attributes (e.g., "time.hour >= 9 AND time.hour < 17")'
                      })
                    ]
                  })
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Decision return"
                  }),
                  " \u2013 The PDP returns one of:",
                  /* @__PURE__ */ jsxs("ul", {
                    className: "mt-2 ml-6 list-inside list-disc space-y-1",
                    children: [
                      /* @__PURE__ */ jsxs("li", {
                        children: [
                          /* @__PURE__ */ jsx("code", {
                            className: "bg-background/50 rounded px-2 py-1",
                            children: "PERMIT"
                          }),
                          " ",
                          "\u2013 The operation is allowed."
                        ]
                      }),
                      /* @__PURE__ */ jsxs("li", {
                        children: [
                          /* @__PURE__ */ jsx("code", {
                            className: "bg-background/50 rounded px-2 py-1",
                            children: "DENY"
                          }),
                          " ",
                          "\u2013 The operation is blocked."
                        ]
                      }),
                      /* @__PURE__ */ jsxs("li", {
                        children: [
                          /* @__PURE__ */ jsx("code", {
                            className: "bg-background/50 rounded px-2 py-1",
                            children: "REDACT"
                          }),
                          " ",
                          "\u2013 The operation is allowed, but sensitive fields are masked."
                        ]
                      })
                    ]
                  })
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Enforcement"
                  }),
                  " \u2013 The runtime enforces the decision. If denied, the operation fails with a clear error message. If redacted, sensitive fields are replaced with placeholders."
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Auditing"
                  }),
                  " \u2013 Every PDP decision is logged to the",
                  " ",
                  /* @__PURE__ */ jsx(Link, {
                    href: "/docs/safety/auditing",
                    className: "text-violet-400 hover:text-violet-300",
                    children: "audit log"
                  }),
                  ", including the request, decision, and reasoning."
                ]
              })
            ]
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Example PolicySpec"
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "Here's a simple policy that restricts access to PII fields:"
          }),
          /* @__PURE__ */ jsx("div", {
            className: "bg-background/50 border-border text-muted-foreground overflow-x-auto rounded-lg border p-4 font-mono text-sm",
            children: /* @__PURE__ */ jsx("pre", {
              children: `policyId: pii-access-control
version: '1.0.0'.0.0
rules:
  - id: allow-admin-full-access
    effect: PERMIT
    condition: user.role == 'admin'
    
  - id: redact-pii-for-support
    effect: REDACT
    condition: |
      user.role == 'support' AND
      field.sensitivity == 'PII'
    redactFields: ['ssn', 'creditCard', 'dateOfBirth']
    
  - id: deny-pii-for-others
    effect: DENY
    condition: |
      user.role NOT IN ['admin', 'support'] AND
      field.sensitivity == 'PII'`
            })
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "With this policy, admins see all data, support staff see redacted PII, and other users cannot access PII at all."
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Benefits of centralized decision-making"
          }),
          /* @__PURE__ */ jsxs("ul", {
            className: "text-muted-foreground list-inside list-disc space-y-2",
            children: [
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Consistency"
                  }),
                  " \u2013 Policies are enforced uniformly across all surfaces (API, UI, workflows)."
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Auditability"
                  }),
                  " \u2013 Every decision is logged, making it easy to trace why access was granted or denied."
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Flexibility"
                  }),
                  " \u2013 Policies can be updated without changing application code."
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Security"
                  }),
                  " \u2013 Reduces the risk of authorization bugs by removing ad-hoc checks scattered throughout the codebase."
                ]
              })
            ]
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Performance considerations"
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "Because the PDP is invoked on every operation, performance is critical. ContractSpec optimizes this by:"
          }),
          /* @__PURE__ */ jsxs("ul", {
            className: "text-muted-foreground list-inside list-disc space-y-2",
            children: [
              /* @__PURE__ */ jsx("li", {
                children: "Caching policy decisions for identical requests"
              }),
              /* @__PURE__ */ jsx("li", {
                children: "Compiling policies into efficient bytecode"
              }),
              /* @__PURE__ */ jsx("li", {
                children: "Evaluating only the minimal set of rules needed for each request"
              }),
              /* @__PURE__ */ jsx("li", {
                children: "Running the PDP in-process to avoid network latency"
              })
            ]
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "In practice, PDP overhead is typically less than 1ms per request."
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "flex items-center gap-4 pt-4",
        children: [
          /* @__PURE__ */ jsx(Link, {
            href: "/docs/safety/signing",
            className: "btn-ghost",
            children: "Previous: Spec Signing"
          }),
          /* @__PURE__ */ jsxs(Link, {
            href: "/docs/safety/auditing",
            className: "btn-primary",
            children: [
              "Next: Audit Logs ",
              /* @__PURE__ */ jsx(ChevronRight, {
                size: 16
              })
            ]
          })
        ]
      })
    ]
  });
}
export {
  SafetyPDPPage
};
