newton-core 0.4.16

use serde::{Deserialize, Serialize};
use std::collections::HashSet;

/// API permission levels for access control
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Deserialize, Serialize)]
#[serde(rename_all = "snake_case")]
pub enum ApiPermission {
    /// Access to JSON-RPC endpoint (includes both read and write methods)
    Rpc,
    /// Permission to execute read-only RPC methods (newt_simulateTask, queries)
    RpcRead,
    /// Permission to execute state-changing RPC methods (newt_createTask, newt_sendTask)
    RpcWrite,
    /// Administrative access to all endpoints and operations
    Admin,
}

impl ApiPermission {
    /// Returns all available permissions
    pub fn all() -> HashSet<Self> {
        use ApiPermission::*;
        [Rpc, RpcRead, RpcWrite, Admin].into_iter().collect()
    }

    /// Returns read-only permissions (safe for public access)
    pub fn read_only() -> HashSet<Self> {
        use ApiPermission::*;
        [RpcRead].into_iter().collect()
    }

    /// Checks if this permission implies another permission
    pub fn implies(&self, other: &Self) -> bool {
        match self {
            Self::Admin => true,
            Self::Rpc => matches!(other, Self::RpcRead | Self::RpcWrite),
            _ => self == other,
        }
    }
}