/**
 * Authorization schema — the single source of truth (@mesh-tech/authz).
 *
 * One resource (`report`) with one gated action (`view`), grantable via the
 * `viewer` relation. `pnpm seed:authz` compiles this to SpiceDB and grants
 * the local dev test user; in the cloud the compiled schema ships through
 * the platform's authz pipeline.
 */

import { defineSchema } from "@mesh-tech/authz/schema";
import { z } from "zod";

const Report = z.object({
  id: z.string(),
  title: z.string(),
});

export const schema = defineSchema({
  namespace: "{{name}}",
  version: "1.0.0",
  subjects: {
    user: { coarseRoles: ["user"], identity: { claim: "sub" } },
  },
  resources: {
    report: {
      schema: Report,
      actions: ["view"] as const,
      relations: {
        viewer: { subject: "user", grants: ["view"], writeAuthority: "app" },
      },
    },
  },
  coarseRoles: ["user"] as const,
  zitadelSync: "coarse",
});