road-runner-common 0.22.0

//! Permission-catalog self-registration payload.
//!
//! A service declares the permissions it enforces so cex-policy can surface drift
//! (granted-but-undeclared / declared-but-ungranted). This is **advisory** — never
//! load-bearing for enforcement — so road-runner stays HTTP-free: it builds the body,
//! the service performs the `POST /internal/authz/manifest` (with whatever client and
//! retry policy it already uses).

use serde::Serialize;

#[derive(Debug, Clone, Serialize)]
pub struct ManifestEntry {
    pub permission: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub description: Option<String>,
}

impl ManifestEntry {
    pub fn new(permission: impl Into<String>) -> Self {
        Self { permission: permission.into(), description: None }
    }

    pub fn description(mut self, d: impl Into<String>) -> Self {
        self.description = Some(d.into());
        self
    }
}

#[derive(Debug, Clone, Serialize)]
pub struct PermissionManifest {
    pub service: String,
    pub permissions: Vec<ManifestEntry>,
}

impl PermissionManifest {
    pub fn new(service: impl Into<String>) -> Self {
        Self { service: service.into(), permissions: Vec::new() }
    }

    pub fn with(mut self, entry: ManifestEntry) -> Self {
        self.permissions.push(entry);
        self
    }

    /// The JSON body to POST to `/internal/authz/manifest`.
    pub fn to_json(&self) -> serde_json::Value {
        serde_json::json!({ "service": self.service, "permissions": self.permissions })
    }
}