//! Grant file schema. A grant is TOML written by the owner to allow one kind of tool call.

use serde::{Deserialize, Serialize};

use crate::{DataClass, Timestamp};

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum Mode {
    Auto,
    Ask,
    Deny,
}

#[derive(Debug, Clone, PartialEq, Eq, Default, Serialize, Deserialize)]
#[serde(rename_all = "lowercase", deny_unknown_fields)]
pub struct Constraints {
    #[serde(default)]
    pub paths: Vec<String>,
    #[serde(default)]
    pub hosts: Vec<String>,
    #[serde(default)]
    pub patterns: Vec<String>,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct Grant {
    pub tool: String,
    pub mode: Mode,
    pub max_taint: DataClass,
    #[serde(default = "default_result_class")]
    pub result_class: DataClass,
    #[serde(default = "default_untrusted")]
    pub untrusted: bool,
    #[serde(default)]
    pub expires: Option<Timestamp>,
    #[serde(default)]
    pub secret: Option<String>,
    #[serde(default)]
    pub constraints: Constraints,
}

fn default_result_class() -> DataClass {
    DataClass::Private
}

fn default_untrusted() -> bool {
    true
}