// src/components/docs/specs/SpecsPolicyPage.tsx
import Link from "@contractspec/lib.ui-link";
import { ChevronRight } from "lucide-react";
import { jsx, jsxs } from "react/jsx-runtime";
function SpecsPolicyPage() {
  return /* @__PURE__ */ jsxs("div", {
    className: "space-y-8",
    children: [
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h1", {
            className: "text-4xl font-bold",
            children: "Policy"
          }),
          /* @__PURE__ */ jsxs("p", {
            className: "text-muted-foreground",
            children: [
              "A ",
              /* @__PURE__ */ jsx("strong", {
                children: "PolicySpec"
              }),
              " defines who can do what, when, and under what conditions. ContractSpec uses attribute-based access control (ABAC) to enforce policies across your entire application—from API endpoints to UI components."
            ]
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Why policies matter"
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "Traditional access control relies on roles (RBAC), which can become unwieldy as applications grow. ABAC is more flexible—it evaluates policies based on attributes of the user, resource, action, and context."
          }),
          /* @__PURE__ */ jsxs("p", {
            className: "text-muted-foreground",
            children: [
              "ContractSpec's policy engine ensures that access control is consistent across all surfaces. You don't have to remember to add authorization checks in every API endpoint or UI component—the",
              " ",
              /* @__PURE__ */ jsx(Link, {
                href: "/docs/safety/pdp",
                className: "text-violet-400 hover:text-violet-300",
                children: "Policy Decision Point"
              }),
              " ",
              "enforces policies automatically."
            ]
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Policy structure"
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "A PolicySpec contains one or more rules. Each rule has:"
          }),
          /* @__PURE__ */ jsxs("ul", {
            className: "text-muted-foreground list-inside list-disc space-y-2",
            children: [
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Effect"
                  }),
                  " – PERMIT, DENY, or REDACT"
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Condition"
                  }),
                  " – A boolean expression that determines when the rule applies"
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Scope"
                  }),
                  " – Which resources, actions, or fields the rule applies to"
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Priority"
                  }),
                  " – Rules are evaluated in priority order; the first matching rule wins"
                ]
              })
            ]
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Example PolicySpec"
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "Here's a policy that controls access to customer data in TypeScript:"
          }),
          /* @__PURE__ */ jsx("div", {
            className: "bg-background/50 border-border text-muted-foreground overflow-x-auto rounded-lg border p-4 font-mono text-sm",
            children: /* @__PURE__ */ jsx("pre", {
              children: `import { definePolicy } from '@contractspec/lib.contracts-spec';

export const CustomerDataAccess = definePolicy({
  meta: {
    key: 'customer.data.access',
    version: '1.0.0',
  },
  rules: [
    {
      id: 'admin-full-access',
      priority: 100,
      effect: 'PERMIT',
      condition: (ctx) => ctx.user.role === 'admin',
      scope: {
        resources: ['customer'],
        actions: ['read', 'write', 'delete'],
      },
    },
    {
      id: 'sales-read-assigned',
      priority: 200,
      effect: 'PERMIT',
      condition: (ctx) => 
        ctx.user.role === 'sales' && 
        ctx.resource.assignedTo === ctx.user.id,
      scope: {
        resources: ['customer'],
        actions: ['read', 'write'],
      },
    },
    {
      id: 'support-read-redacted',
      priority: 300,
      effect: 'REDACT',
      condition: (ctx) => ctx.user.role === 'support',
      scope: {
        resources: ['customer'],
        actions: ['read'],
      },
      redactFields: ['creditCard', 'ssn', 'bankAccount'],
    },
  ],
});`
            })
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Attributes"
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "Policy conditions can reference attributes from four categories:"
          }),
          /* @__PURE__ */ jsxs("div", {
            className: "space-y-3",
            children: [
              /* @__PURE__ */ jsxs("div", {
                children: [
                  /* @__PURE__ */ jsx("h3", {
                    className: "text-lg font-semibold",
                    children: "User attributes"
                  }),
                  /* @__PURE__ */ jsxs("p", {
                    className: "text-muted-foreground",
                    children: [
                      /* @__PURE__ */ jsx("code", {
                        className: "bg-background/50 rounded px-2 py-1",
                        children: "user.id"
                      }),
                      ",",
                      " ",
                      /* @__PURE__ */ jsx("code", {
                        className: "bg-background/50 rounded px-2 py-1",
                        children: "user.role"
                      }),
                      ",",
                      " ",
                      /* @__PURE__ */ jsx("code", {
                        className: "bg-background/50 rounded px-2 py-1",
                        children: "user.groups"
                      }),
                      ",",
                      " ",
                      /* @__PURE__ */ jsx("code", {
                        className: "bg-background/50 rounded px-2 py-1",
                        children: "user.department"
                      }),
                      ", custom attributes"
                    ]
                  })
                ]
              }),
              /* @__PURE__ */ jsxs("div", {
                children: [
                  /* @__PURE__ */ jsx("h3", {
                    className: "text-lg font-semibold",
                    children: "Resource attributes"
                  }),
                  /* @__PURE__ */ jsxs("p", {
                    className: "text-muted-foreground",
                    children: [
                      /* @__PURE__ */ jsx("code", {
                        className: "bg-background/50 rounded px-2 py-1",
                        children: "resource.type"
                      }),
                      ",",
                      " ",
                      /* @__PURE__ */ jsx("code", {
                        className: "bg-background/50 rounded px-2 py-1",
                        children: "resource.owner"
                      }),
                      ",",
                      " ",
                      /* @__PURE__ */ jsx("code", {
                        className: "bg-background/50 rounded px-2 py-1",
                        children: "resource.sensitivity"
                      }),
                      ", custom attributes"
                    ]
                  })
                ]
              }),
              /* @__PURE__ */ jsxs("div", {
                children: [
                  /* @__PURE__ */ jsx("h3", {
                    className: "text-lg font-semibold",
                    children: "Action attributes"
                  }),
                  /* @__PURE__ */ jsxs("p", {
                    className: "text-muted-foreground",
                    children: [
                      /* @__PURE__ */ jsx("code", {
                        className: "bg-background/50 rounded px-2 py-1",
                        children: "action"
                      }),
                      " ",
                      "(read, write, delete, execute, export, etc.)"
                    ]
                  })
                ]
              }),
              /* @__PURE__ */ jsxs("div", {
                children: [
                  /* @__PURE__ */ jsx("h3", {
                    className: "text-lg font-semibold",
                    children: "Context attributes"
                  }),
                  /* @__PURE__ */ jsxs("p", {
                    className: "text-muted-foreground",
                    children: [
                      /* @__PURE__ */ jsx("code", {
                        className: "bg-background/50 rounded px-2 py-1",
                        children: "time.hour"
                      }),
                      ",",
                      " ",
                      /* @__PURE__ */ jsx("code", {
                        className: "bg-background/50 rounded px-2 py-1",
                        children: "time.dayOfWeek"
                      }),
                      ",",
                      " ",
                      /* @__PURE__ */ jsx("code", {
                        className: "bg-background/50 rounded px-2 py-1",
                        children: "request.ipAddress"
                      }),
                      ",",
                      " ",
                      /* @__PURE__ */ jsx("code", {
                        className: "bg-background/50 rounded px-2 py-1",
                        children: "request.userAgent"
                      })
                    ]
                  })
                ]
              })
            ]
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Data classification"
          }),
          /* @__PURE__ */ jsxs("p", {
            className: "text-muted-foreground",
            children: [
              "You can tag fields with sensitivity levels in your",
              " ",
              /* @__PURE__ */ jsx(Link, {
                href: "/docs/specs/capabilities",
                className: "text-violet-400 hover:text-violet-300",
                children: "CapabilitySpecs"
              }),
              " ",
              "and",
              " ",
              /* @__PURE__ */ jsx(Link, {
                href: "/docs/specs/dataviews",
                className: "text-violet-400 hover:text-violet-300",
                children: "DataViewSpecs"
              }),
              ":"
            ]
          }),
          /* @__PURE__ */ jsx("div", {
            className: "bg-background/50 border-border text-muted-foreground overflow-x-auto rounded-lg border p-4 font-mono text-sm",
            children: /* @__PURE__ */ jsx("pre", {
              children: `fields:
  - name: email
    type: string
    sensitivity: PII
  - name: creditCard
    type: string
    sensitivity: PII
    encrypted: true
  - name: diagnosis
    type: string
    sensitivity: PHI
  - name: salary
    type: number
    sensitivity: confidential`
            })
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: 'Policies can then reference these tags to enforce blanket rules like "support staff cannot see PII" or "PHI can only be accessed from approved IP addresses."'
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Testing policies"
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "ContractSpec provides tools for testing policies before deployment:"
          }),
          /* @__PURE__ */ jsxs("ul", {
            className: "text-muted-foreground list-inside list-disc space-y-2",
            children: [
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Policy simulator"
                  }),
                  " – Test how policies evaluate for different users and scenarios"
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Coverage analysis"
                  }),
                  " – Identify resources or actions that aren't covered by any policy"
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Conflict detection"
                  }),
                  " – Find rules that might conflict or produce unexpected results"
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Audit mode"
                  }),
                  " – Run policies in audit-only mode to see what would be blocked without actually blocking it"
                ]
              })
            ]
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Best practices"
          }),
          /* @__PURE__ */ jsxs("ul", {
            className: "text-muted-foreground list-inside list-disc space-y-2",
            children: [
              /* @__PURE__ */ jsx("li", {
                children: "Start with a deny-by-default policy—explicitly permit what should be allowed."
              }),
              /* @__PURE__ */ jsx("li", {
                children: "Use clear, descriptive rule IDs that explain what the rule does."
              }),
              /* @__PURE__ */ jsx("li", {
                children: "Set priorities carefully to ensure rules are evaluated in the right order."
              }),
              /* @__PURE__ */ jsx("li", {
                children: "Test policies thoroughly with realistic user scenarios before deploying."
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  "Monitor policy decisions in production using",
                  " ",
                  /* @__PURE__ */ jsx(Link, {
                    href: "/docs/safety/auditing",
                    className: "text-violet-400 hover:text-violet-300",
                    children: "audit logs"
                  }),
                  "."
                ]
              }),
              /* @__PURE__ */ jsx("li", {
                children: "Review and update policies regularly as your application and requirements evolve."
              })
            ]
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "flex items-center gap-4 pt-4",
        children: [
          /* @__PURE__ */ jsx(Link, {
            href: "/docs/specs/workflows",
            className: "btn-ghost",
            children: "Previous: Workflows"
          }),
          /* @__PURE__ */ jsxs(Link, {
            href: "/docs/specs/overlays",
            className: "btn-primary",
            children: [
              "Next: Overlays ",
              /* @__PURE__ */ jsx(ChevronRight, {
                size: 16
              })
            ]
          })
        ]
      })
    ]
  });
}
export {
  SpecsPolicyPage
};
