#!/usr/bin/env python3
"""CASAN RBAC — role-based access control decision engine (Plan-14 core, harness-owned).

Reusable governance asset in the core harness (not in any generated app). The
Control Plane web app and any harness action call this to authorize a request.

Model: role × (resource:action) with scope. deny-by-default + fail-closed:
unknown role / action / cross-tenant / sensitive-without-org-admin ⇒ DENY.
Separation of Duties (SoD): a proposer cannot approve their own request.

Exit codes: 0 = ALLOW, 1 = DENY. Reason printed to stderr.
"""
import argparse
import sys


# scope: "org" (all projects) or "project" (must match the acted-on project)
PERMISSIONS = {
    "org-admin": {"scope": "org", "allow": {"*"}},
    "project-admin": {"scope": "project", "allow": {"settings:read", "settings:write", "monitoring:read", "audit:read"}},
    "approver": {"scope": "project", "allow": {"settings:read", "monitoring:read", "approval:grant"}},
    "operator": {"scope": "project", "allow": {"monitoring:read", "kill_switch:engage"}},
    "viewer": {"scope": "project", "allow": {"settings:read", "monitoring:read"}},
    "auditor": {"scope": "org", "allow": {"settings:read", "monitoring:read", "audit:read"}},
}

# Maps an IdP-issued claim (role name / group) to an RBAC role. The IdP (Plan-07
# C4) is the identity authority; RBAC only maps a *verified* claim to a role.
# deny-by-default: an unmapped claim yields no role.
CLAIM_ROLE_MAP = {
    "casan-org-admin": "org-admin",
    "casan-project-admin": "project-admin",
    "casan-approver": "approver",
    "casan-operator": "operator",
    "casan-viewer": "viewer",
    "casan-auditor": "auditor",
}


def decide(role, resource, action, role_project, target_project, sensitive):
    perm = PERMISSIONS.get(role)
    if perm is None:
        return False, f"UNKNOWN_ROLE {role}"

    action_key = f"{resource}:{action}"

    # Sensitive settings writes are org-admin only, regardless of other grants.
    if sensitive and not (resource == "settings" and action == "write"):
        # sensitivity only meaningful for settings:write
        pass
    if sensitive and resource == "settings" and action == "write" and role != "org-admin":
        return False, f"SENSITIVE_REQUIRES_ORG_ADMIN {action_key}"

    if "*" in perm["allow"]:
        return True, "ALLOW org-admin"

    if action_key not in perm["allow"]:
        return False, f"ACTION_NOT_ALLOWED {role} {action_key}"

    if perm["scope"] == "project":
        if not role_project or not target_project:
            return False, "PROJECT_SCOPE_REQUIRED"
        if role_project != target_project:
            return False, f"CROSS_TENANT {role_project}!={target_project}"

    return True, f"ALLOW {role} {action_key}"


def main() -> int:
    ap = argparse.ArgumentParser()
    sub = ap.add_subparsers(dest="cmd", required=True)

    c = sub.add_parser("check")
    c.add_argument("--role", required=True)
    c.add_argument("--resource", required=True)
    c.add_argument("--action", required=True)
    c.add_argument("--role-project", default="")
    c.add_argument("--target-project", default="")
    c.add_argument("--sensitive", action="store_true")

    s = sub.add_parser("check-sod")
    s.add_argument("--proposer", required=True)
    s.add_argument("--approver", required=True)

    p = sub.add_parser("list-roles")

    m = sub.add_parser("map-claim")
    m.add_argument("--claim", required=True, help="IdP-issued role/group claim")

    args = ap.parse_args()

    if args.cmd == "list-roles":
        for role, perm in PERMISSIONS.items():
            print(f"{role} scope={perm['scope']} allow={sorted(perm['allow'])}")
        return 0

    if args.cmd == "map-claim":
        role = CLAIM_ROLE_MAP.get(args.claim)
        if role is None:
            print(f"RBAC_DENY UNKNOWN_CLAIM {args.claim}", file=sys.stderr)
            return 1
        print(role)
        return 0

    if args.cmd == "check-sod":
        if args.proposer == args.approver:
            print(f"RBAC_DENY SOD_SELF_APPROVAL actor={args.approver}", file=sys.stderr)
            return 1
        print(f"RBAC_ALLOW SOD_OK proposer={args.proposer} approver={args.approver}")
        return 0

    allowed, reason = decide(
        args.role, args.resource, args.action, args.role_project, args.target_project, args.sensitive
    )
    if allowed:
        print(f"RBAC_ALLOW {reason}")
        return 0
    print(f"RBAC_DENY {reason}", file=sys.stderr)
    return 1


if __name__ == "__main__":
    raise SystemExit(main())