/**
 * Permission Definitions for Role-Based Access Control (RBAC)
 *
 * Defines a comprehensive permission system with:
 * - Resource-based permissions (resource:action format)
 * - Wildcard support for flexible permission patterns
 * - Permission categories for organization
 * - Permission validation and matching
 *
 * Permission format: `resource:action` or `resource:action:scope`
 * Examples:
 * - `intent:read` - Read any intent
 * - `intent:*` - All actions on intents
 * - `*` - All permissions (super admin)
 * - `tenant:user:create` - Create users within tenant scope
 *
 * @packageDocumentation
 */
import { z } from 'zod';
// =============================================================================
// PERMISSION TYPES
// =============================================================================
/**
 * Permission actions that can be performed on resources
 */
export const PermissionActions = {
    // CRUD operations
    CREATE: 'create',
    READ: 'read',
    UPDATE: 'update',
    DELETE: 'delete',
    LIST: 'list',
    // Specialized operations
    EXECUTE: 'execute',
    APPROVE: 'approve',
    REJECT: 'reject',
    ESCALATE: 'escalate',
    VERIFY: 'verify',
    EXPORT: 'export',
    IMPORT: 'import',
    ANALYZE: 'analyze',
    MANAGE: 'manage',
    CONFIGURE: 'configure',
    // Wildcard
    ALL: '*',
};
/**
 * Resource types that can be protected
 */
export const ResourceTypes = {
    // Core resources
    TENANT: 'tenant',
    USER: 'user',
    AGENT: 'agent',
    SERVICE: 'service',
    // Intent/governance resources
    INTENT: 'intent',
    POLICY: 'policy',
    CONSTRAINT: 'constraint',
    ESCALATION: 'escalation',
    // Audit/proof resources
    PROOF: 'proof',
    AUDIT: 'audit',
    AUDIT_LOG: 'audit_log',
    // Configuration resources
    CONFIG: 'config',
    ROLE: 'role',
    PERMISSION: 'permission',
    API_KEY: 'api_key',
    WEBHOOK: 'webhook',
    // Security resources
    SESSION: 'session',
    TOKEN: 'token',
    CREDENTIAL: 'credential',
    SECRET: 'secret',
    KEY: 'key',
    // Operational resources
    DASHBOARD: 'dashboard',
    REPORT: 'report',
    MONITORING: 'monitoring',
    HEALTH: 'health',
    METRICS: 'metrics',
    // Public resources
    PUBLIC: 'public',
    PROFILE: 'profile',
    // Trust resources
    TRUST_SCORE: 'trust_score',
    TRUST_SIGNAL: 'trust_signal',
    // Wildcard
    ALL: '*',
};
/**
 * Permission categories for organization
 */
export const PermissionCategories = {
    ADMINISTRATION: 'administration',
    OPERATIONS: 'operations',
    SECURITY: 'security',
    AUDIT: 'audit',
    CONFIGURATION: 'configuration',
    MONITORING: 'monitoring',
    PUBLIC: 'public',
};
// =============================================================================
// ZOD SCHEMAS
// =============================================================================
export const permissionDefinitionSchema = z.object({
    id: z.string().min(1),
    name: z.string().min(1).max(100),
    description: z.string().max(500),
    resource: z.string(),
    action: z.string(),
    category: z.nativeEnum(PermissionCategories),
    sensitive: z.boolean(),
    compliance: z.array(z.string()).optional(),
    isSystemPermission: z.boolean(),
    metadata: z.record(z.unknown()).optional(),
});
export const permissionCheckRequestSchema = z.object({
    subjectId: z.string(),
    subjectType: z.enum(['user', 'agent', 'service']),
    permissions: z.array(z.string()).min(1),
    resourceId: z.string().optional(),
    resourceType: z.string().optional(),
    tenantId: z.string().optional(),
    context: z.record(z.unknown()).optional(),
});
export const permissionCheckResultSchema = z.object({
    granted: z.boolean(),
    grantedPermissions: z.array(z.string()),
    deniedPermissions: z.array(z.string()),
    reason: z.string().optional(),
    grantSource: z.enum(['role', 'direct', 'inherited', 'wildcard']).optional(),
    grantingRole: z.string().optional(),
    evaluatedAt: z.string().datetime(),
});
// =============================================================================
// BUILT-IN PERMISSIONS
// =============================================================================
/**
 * Get all built-in system permissions
 */
export function getBuiltinPermissions() {
    return [
        // -------------------------------------------------------------------------
        // Administration Permissions
        // -------------------------------------------------------------------------
        {
            id: 'tenant:create',
            name: 'Create Tenant',
            description: 'Create new tenants',
            resource: ResourceTypes.TENANT,
            action: PermissionActions.CREATE,
            category: PermissionCategories.ADMINISTRATION,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'tenant:read',
            name: 'Read Tenant',
            description: 'View tenant information',
            resource: ResourceTypes.TENANT,
            action: PermissionActions.READ,
            category: PermissionCategories.ADMINISTRATION,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'tenant:update',
            name: 'Update Tenant',
            description: 'Modify tenant configuration',
            resource: ResourceTypes.TENANT,
            action: PermissionActions.UPDATE,
            category: PermissionCategories.ADMINISTRATION,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'tenant:delete',
            name: 'Delete Tenant',
            description: 'Delete tenant and all associated data',
            resource: ResourceTypes.TENANT,
            action: PermissionActions.DELETE,
            category: PermissionCategories.ADMINISTRATION,
            sensitive: true,
            compliance: ['SOC2', 'GDPR'],
            isSystemPermission: true,
        },
        {
            id: 'user:create',
            name: 'Create User',
            description: 'Create new user accounts',
            resource: ResourceTypes.USER,
            action: PermissionActions.CREATE,
            category: PermissionCategories.ADMINISTRATION,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'user:read',
            name: 'Read User',
            description: 'View user information',
            resource: ResourceTypes.USER,
            action: PermissionActions.READ,
            category: PermissionCategories.ADMINISTRATION,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'user:update',
            name: 'Update User',
            description: 'Modify user accounts',
            resource: ResourceTypes.USER,
            action: PermissionActions.UPDATE,
            category: PermissionCategories.ADMINISTRATION,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'user:delete',
            name: 'Delete User',
            description: 'Delete user accounts',
            resource: ResourceTypes.USER,
            action: PermissionActions.DELETE,
            category: PermissionCategories.ADMINISTRATION,
            sensitive: true,
            compliance: ['SOC2', 'GDPR'],
            isSystemPermission: true,
        },
        {
            id: 'role:create',
            name: 'Create Role',
            description: 'Create new roles',
            resource: ResourceTypes.ROLE,
            action: PermissionActions.CREATE,
            category: PermissionCategories.ADMINISTRATION,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'role:read',
            name: 'Read Role',
            description: 'View role definitions',
            resource: ResourceTypes.ROLE,
            action: PermissionActions.READ,
            category: PermissionCategories.ADMINISTRATION,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'role:update',
            name: 'Update Role',
            description: 'Modify role definitions',
            resource: ResourceTypes.ROLE,
            action: PermissionActions.UPDATE,
            category: PermissionCategories.ADMINISTRATION,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'role:delete',
            name: 'Delete Role',
            description: 'Delete role definitions',
            resource: ResourceTypes.ROLE,
            action: PermissionActions.DELETE,
            category: PermissionCategories.ADMINISTRATION,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'role:assign',
            name: 'Assign Role',
            description: 'Assign roles to users/agents',
            resource: ResourceTypes.ROLE,
            action: 'assign',
            category: PermissionCategories.ADMINISTRATION,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        // -------------------------------------------------------------------------
        // Operations Permissions
        // -------------------------------------------------------------------------
        {
            id: 'intent:create',
            name: 'Create Intent',
            description: 'Submit new intents for evaluation',
            resource: ResourceTypes.INTENT,
            action: PermissionActions.CREATE,
            category: PermissionCategories.OPERATIONS,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'intent:read',
            name: 'Read Intent',
            description: 'View intent details',
            resource: ResourceTypes.INTENT,
            action: PermissionActions.READ,
            category: PermissionCategories.OPERATIONS,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'intent:update',
            name: 'Update Intent',
            description: 'Modify intent details',
            resource: ResourceTypes.INTENT,
            action: PermissionActions.UPDATE,
            category: PermissionCategories.OPERATIONS,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'intent:approve',
            name: 'Approve Intent',
            description: 'Approve pending intents',
            resource: ResourceTypes.INTENT,
            action: PermissionActions.APPROVE,
            category: PermissionCategories.OPERATIONS,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'intent:reject',
            name: 'Reject Intent',
            description: 'Reject pending intents',
            resource: ResourceTypes.INTENT,
            action: PermissionActions.REJECT,
            category: PermissionCategories.OPERATIONS,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'intent:analyze',
            name: 'Analyze Intent',
            description: 'Perform analysis on intents',
            resource: ResourceTypes.INTENT,
            action: PermissionActions.ANALYZE,
            category: PermissionCategories.OPERATIONS,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'escalation:create',
            name: 'Create Escalation',
            description: 'Create escalation requests',
            resource: ResourceTypes.ESCALATION,
            action: PermissionActions.CREATE,
            category: PermissionCategories.OPERATIONS,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'escalation:read',
            name: 'Read Escalation',
            description: 'View escalation details',
            resource: ResourceTypes.ESCALATION,
            action: PermissionActions.READ,
            category: PermissionCategories.OPERATIONS,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'escalation:approve',
            name: 'Approve Escalation',
            description: 'Approve escalation requests',
            resource: ResourceTypes.ESCALATION,
            action: PermissionActions.APPROVE,
            category: PermissionCategories.OPERATIONS,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'escalation:reject',
            name: 'Reject Escalation',
            description: 'Reject escalation requests',
            resource: ResourceTypes.ESCALATION,
            action: PermissionActions.REJECT,
            category: PermissionCategories.OPERATIONS,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'policy:create',
            name: 'Create Policy',
            description: 'Create governance policies',
            resource: ResourceTypes.POLICY,
            action: PermissionActions.CREATE,
            category: PermissionCategories.OPERATIONS,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'policy:read',
            name: 'Read Policy',
            description: 'View policy definitions',
            resource: ResourceTypes.POLICY,
            action: PermissionActions.READ,
            category: PermissionCategories.OPERATIONS,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'policy:update',
            name: 'Update Policy',
            description: 'Modify policy definitions',
            resource: ResourceTypes.POLICY,
            action: PermissionActions.UPDATE,
            category: PermissionCategories.OPERATIONS,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'policy:delete',
            name: 'Delete Policy',
            description: 'Delete policy definitions',
            resource: ResourceTypes.POLICY,
            action: PermissionActions.DELETE,
            category: PermissionCategories.OPERATIONS,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        // -------------------------------------------------------------------------
        // Audit Permissions
        // -------------------------------------------------------------------------
        {
            id: 'proof:read',
            name: 'Read Proof',
            description: 'View proof records',
            resource: ResourceTypes.PROOF,
            action: PermissionActions.READ,
            category: PermissionCategories.AUDIT,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'proof:verify',
            name: 'Verify Proof',
            description: 'Verify proof authenticity',
            resource: ResourceTypes.PROOF,
            action: PermissionActions.VERIFY,
            category: PermissionCategories.AUDIT,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'proof:export',
            name: 'Export Proof',
            description: 'Export proof records',
            resource: ResourceTypes.PROOF,
            action: PermissionActions.EXPORT,
            category: PermissionCategories.AUDIT,
            sensitive: true,
            compliance: ['SOC2', 'GDPR'],
            isSystemPermission: true,
        },
        {
            id: 'audit:read',
            name: 'Read Audit Log',
            description: 'View audit log entries',
            resource: ResourceTypes.AUDIT,
            action: PermissionActions.READ,
            category: PermissionCategories.AUDIT,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'audit:export',
            name: 'Export Audit Log',
            description: 'Export audit log entries',
            resource: ResourceTypes.AUDIT,
            action: PermissionActions.EXPORT,
            category: PermissionCategories.AUDIT,
            sensitive: true,
            compliance: ['SOC2', 'GDPR'],
            isSystemPermission: true,
        },
        // -------------------------------------------------------------------------
        // Security Permissions
        // -------------------------------------------------------------------------
        {
            id: 'api_key:create',
            name: 'Create API Key',
            description: 'Create new API keys',
            resource: ResourceTypes.API_KEY,
            action: PermissionActions.CREATE,
            category: PermissionCategories.SECURITY,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'api_key:read',
            name: 'Read API Key',
            description: 'View API key information',
            resource: ResourceTypes.API_KEY,
            action: PermissionActions.READ,
            category: PermissionCategories.SECURITY,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'api_key:delete',
            name: 'Delete API Key',
            description: 'Revoke API keys',
            resource: ResourceTypes.API_KEY,
            action: PermissionActions.DELETE,
            category: PermissionCategories.SECURITY,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'session:read',
            name: 'Read Session',
            description: 'View active sessions',
            resource: ResourceTypes.SESSION,
            action: PermissionActions.READ,
            category: PermissionCategories.SECURITY,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'session:delete',
            name: 'Delete Session',
            description: 'Terminate active sessions',
            resource: ResourceTypes.SESSION,
            action: PermissionActions.DELETE,
            category: PermissionCategories.SECURITY,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'secret:read',
            name: 'Read Secret',
            description: 'Access secrets',
            resource: ResourceTypes.SECRET,
            action: PermissionActions.READ,
            category: PermissionCategories.SECURITY,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'secret:manage',
            name: 'Manage Secret',
            description: 'Create, update, and rotate secrets',
            resource: ResourceTypes.SECRET,
            action: PermissionActions.MANAGE,
            category: PermissionCategories.SECURITY,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        // -------------------------------------------------------------------------
        // Configuration Permissions
        // -------------------------------------------------------------------------
        {
            id: 'config:read',
            name: 'Read Configuration',
            description: 'View system configuration',
            resource: ResourceTypes.CONFIG,
            action: PermissionActions.READ,
            category: PermissionCategories.CONFIGURATION,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'config:update',
            name: 'Update Configuration',
            description: 'Modify system configuration',
            resource: ResourceTypes.CONFIG,
            action: PermissionActions.UPDATE,
            category: PermissionCategories.CONFIGURATION,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'webhook:create',
            name: 'Create Webhook',
            description: 'Create webhook configurations',
            resource: ResourceTypes.WEBHOOK,
            action: PermissionActions.CREATE,
            category: PermissionCategories.CONFIGURATION,
            sensitive: true,
            isSystemPermission: true,
        },
        {
            id: 'webhook:read',
            name: 'Read Webhook',
            description: 'View webhook configurations',
            resource: ResourceTypes.WEBHOOK,
            action: PermissionActions.READ,
            category: PermissionCategories.CONFIGURATION,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'webhook:update',
            name: 'Update Webhook',
            description: 'Modify webhook configurations',
            resource: ResourceTypes.WEBHOOK,
            action: PermissionActions.UPDATE,
            category: PermissionCategories.CONFIGURATION,
            sensitive: true,
            isSystemPermission: true,
        },
        {
            id: 'webhook:delete',
            name: 'Delete Webhook',
            description: 'Delete webhook configurations',
            resource: ResourceTypes.WEBHOOK,
            action: PermissionActions.DELETE,
            category: PermissionCategories.CONFIGURATION,
            sensitive: true,
            isSystemPermission: true,
        },
        // -------------------------------------------------------------------------
        // Monitoring Permissions
        // -------------------------------------------------------------------------
        {
            id: 'dashboard:read',
            name: 'Read Dashboard',
            description: 'View dashboard data',
            resource: ResourceTypes.DASHBOARD,
            action: PermissionActions.READ,
            category: PermissionCategories.MONITORING,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'report:read',
            name: 'Read Report',
            description: 'View reports',
            resource: ResourceTypes.REPORT,
            action: PermissionActions.READ,
            category: PermissionCategories.MONITORING,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'report:create',
            name: 'Create Report',
            description: 'Generate new reports',
            resource: ResourceTypes.REPORT,
            action: PermissionActions.CREATE,
            category: PermissionCategories.MONITORING,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'report:export',
            name: 'Export Report',
            description: 'Export report data',
            resource: ResourceTypes.REPORT,
            action: PermissionActions.EXPORT,
            category: PermissionCategories.MONITORING,
            sensitive: true,
            compliance: ['GDPR'],
            isSystemPermission: true,
        },
        {
            id: 'monitoring:read',
            name: 'Read Monitoring',
            description: 'View monitoring data',
            resource: ResourceTypes.MONITORING,
            action: PermissionActions.READ,
            category: PermissionCategories.MONITORING,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'metrics:read',
            name: 'Read Metrics',
            description: 'View system metrics',
            resource: ResourceTypes.METRICS,
            action: PermissionActions.READ,
            category: PermissionCategories.MONITORING,
            sensitive: false,
            isSystemPermission: true,
        },
        // -------------------------------------------------------------------------
        // Public Permissions
        // -------------------------------------------------------------------------
        {
            id: 'public:read',
            name: 'Read Public',
            description: 'Access public information',
            resource: ResourceTypes.PUBLIC,
            action: PermissionActions.READ,
            category: PermissionCategories.PUBLIC,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'health:read',
            name: 'Read Health',
            description: 'View health check endpoints',
            resource: ResourceTypes.HEALTH,
            action: PermissionActions.READ,
            category: PermissionCategories.PUBLIC,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'profile:read',
            name: 'Read Profile',
            description: 'View own profile information',
            resource: ResourceTypes.PROFILE,
            action: PermissionActions.READ,
            category: PermissionCategories.PUBLIC,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'profile:update',
            name: 'Update Profile',
            description: 'Modify own profile information',
            resource: ResourceTypes.PROFILE,
            action: PermissionActions.UPDATE,
            category: PermissionCategories.PUBLIC,
            sensitive: false,
            isSystemPermission: true,
        },
        // -------------------------------------------------------------------------
        // Trust Permissions
        // -------------------------------------------------------------------------
        {
            id: 'trust_score:read',
            name: 'Read Trust Score',
            description: 'View trust scores',
            resource: ResourceTypes.TRUST_SCORE,
            action: PermissionActions.READ,
            category: PermissionCategories.OPERATIONS,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'trust_score:manage',
            name: 'Manage Trust Score',
            description: 'Modify trust scores',
            resource: ResourceTypes.TRUST_SCORE,
            action: PermissionActions.MANAGE,
            category: PermissionCategories.ADMINISTRATION,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
        {
            id: 'trust_signal:create',
            name: 'Create Trust Signal',
            description: 'Submit trust signals',
            resource: ResourceTypes.TRUST_SIGNAL,
            action: PermissionActions.CREATE,
            category: PermissionCategories.OPERATIONS,
            sensitive: false,
            isSystemPermission: true,
        },
        {
            id: 'trust_signal:read',
            name: 'Read Trust Signal',
            description: 'View trust signals',
            resource: ResourceTypes.TRUST_SIGNAL,
            action: PermissionActions.READ,
            category: PermissionCategories.OPERATIONS,
            sensitive: false,
            isSystemPermission: true,
        },
        // -------------------------------------------------------------------------
        // Wildcard Permissions
        // -------------------------------------------------------------------------
        {
            id: '*',
            name: 'Super Admin',
            description: 'All permissions (super administrator)',
            resource: ResourceTypes.ALL,
            action: PermissionActions.ALL,
            category: PermissionCategories.ADMINISTRATION,
            sensitive: true,
            compliance: ['SOC2'],
            isSystemPermission: true,
        },
    ];
}
// =============================================================================
// PERMISSION UTILITIES
// =============================================================================
/**
 * Parse a permission string into resource and action
 */
export function parsePermission(permission) {
    const parts = permission.split(':');
    if (parts.length === 1) {
        return { resource: parts[0], action: '*' };
    }
    if (parts.length === 2) {
        return { resource: parts[0], action: parts[1] };
    }
    return {
        resource: parts[0],
        action: parts[1],
        scope: parts.slice(2).join(':'),
    };
}
/**
 * Build a permission string from components
 */
export function buildPermission(resource, action, scope) {
    if (scope) {
        return `${resource}:${action}:${scope}`;
    }
    return `${resource}:${action}`;
}
/**
 * Check if a permission string matches a required permission
 * Supports wildcard matching
 */
export function permissionMatches(granted, required) {
    // Universal wildcard
    if (granted === '*') {
        return true;
    }
    const grantedParts = parsePermission(granted);
    const requiredParts = parsePermission(required);
    // Check resource match
    if (grantedParts.resource !== '*' && grantedParts.resource !== requiredParts.resource) {
        return false;
    }
    // Check action match
    if (grantedParts.action !== '*' && grantedParts.action !== requiredParts.action) {
        return false;
    }
    // Check scope match (if present)
    if (grantedParts.scope && requiredParts.scope) {
        if (grantedParts.scope !== '*' && grantedParts.scope !== requiredParts.scope) {
            return false;
        }
    }
    return true;
}
/**
 * Check if any granted permission matches the required permission
 */
export function hasPermission(grantedPermissions, requiredPermission) {
    const permissions = grantedPermissions instanceof Set
        ? grantedPermissions
        : new Set(grantedPermissions);
    for (const granted of permissions) {
        if (permissionMatches(granted, requiredPermission)) {
            return true;
        }
    }
    return false;
}
/**
 * Check if all required permissions are granted
 */
export function hasAllPermissions(grantedPermissions, requiredPermissions) {
    return requiredPermissions.every(required => hasPermission(grantedPermissions, required));
}
/**
 * Check if any of the required permissions are granted
 */
export function hasAnyPermission(grantedPermissions, requiredPermissions) {
    return requiredPermissions.some(required => hasPermission(grantedPermissions, required));
}
/**
 * Get all permissions that match a pattern
 */
export function filterMatchingPermissions(allPermissions, pattern) {
    return allPermissions.filter(perm => permissionMatches(pattern, perm));
}
/**
 * Validate a permission string format
 */
export function isValidPermissionFormat(permission) {
    // Allow single wildcard
    if (permission === '*') {
        return true;
    }
    // Must be resource:action format
    const parts = permission.split(':');
    if (parts.length < 1 || parts.length > 3) {
        return false;
    }
    // Each part must be alphanumeric with underscores or wildcard
    const validPart = /^[\w*]+$/;
    return parts.every(part => validPart.test(part));
}
/**
 * Get permissions grouped by category
 */
export function getPermissionsByCategory() {
    const permissions = getBuiltinPermissions();
    const grouped = {
        [PermissionCategories.ADMINISTRATION]: [],
        [PermissionCategories.OPERATIONS]: [],
        [PermissionCategories.SECURITY]: [],
        [PermissionCategories.AUDIT]: [],
        [PermissionCategories.CONFIGURATION]: [],
        [PermissionCategories.MONITORING]: [],
        [PermissionCategories.PUBLIC]: [],
    };
    for (const perm of permissions) {
        grouped[perm.category].push(perm);
    }
    return grouped;
}
/**
 * Get sensitive permissions
 */
export function getSensitivePermissions() {
    return getBuiltinPermissions().filter(p => p.sensitive);
}
/**
 * Get permissions required for compliance
 */
export function getCompliancePermissions(compliance) {
    return getBuiltinPermissions().filter(p => p.compliance?.includes(compliance));
}
/**
 * Create a custom permission definition
 */
export function createPermissionDefinition(partial) {
    return {
        ...partial,
        isSystemPermission: partial.isSystemPermission ?? false,
    };
}
//# sourceMappingURL=permissions.js.map