#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(transparent)]
pub struct PolicyId(String);

pub fn new(id: impl Into<String>) -> ArsenalResult<Self>;

#[must_use]
pub fn generate() -> Self;

#[must_use]
pub fn as_str(&self) -> &str;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PolicyDocument {
/// Policy ID

pub id: PolicyId,
/// Policy version (for updates)

pub version: u32,
/// Tenant this policy belongs to

pub tenant_id: TenantId,
/// Human-readable name

pub name: String,
/// Description

#[serde(skip_serializing_if = "Option::is_none")]
pub description: Option<String>,
/// Policy rules

pub rules: Vec<PolicyRule>,
/// Default effect when no rules match

pub default_effect: PolicyEffect,
/// Whether this policy is active

pub is_active: bool,
/// Priority (higher = evaluated first)

pub priority: i32,
/// When the policy was created

pub created_at: chrono::DateTime<chrono::Utc>,
/// When the policy was last modified

pub updated_at: chrono::DateTime<chrono::Utc>,
/// Policy signature (if signed)

#[serde(skip_serializing_if = "Option::is_none")]
pub signature: Option<PolicySignature>,
/// Custom labels

#[serde(default)]
pub labels: HashMap<String, String>
}

pub fn new(tenant_id: TenantId, name: impl Into<String>) -> ArsenalResult<Self>;

pub fn add_rule(&mut self, rule: PolicyRule) -> ArsenalResult<()>;

#[must_use]
pub fn evaluate(&self, request: &PolicyRequest) -> PolicyDecision;

pub fn to_cbor(&self) -> ArsenalResult<Vec<u8>>;

pub fn from_cbor(bytes: &[u8]) -> ArsenalResult<Self>;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PolicyRule {
/// Rule ID (unique within policy)

pub id: String,
/// Rule description

#[serde(skip_serializing_if = "Option::is_none")]
pub description: Option<String>,
/// Effect when rule matches

pub effect: PolicyEffect,
/// Conditions that must be met

pub conditions: Vec<PolicyCondition>,
/// Scopes this rule applies to

#[serde(skip_serializing_if = "Option::is_none")]
pub scopes: Option<ScopeSet>,
/// Constraints to apply

#[serde(skip_serializing_if = "Option::is_none")]
pub constraints: Option<Constraints>,
/// Rate limits to apply

#[serde(skip_serializing_if = "Option::is_none")]
pub rate_limits: Option<RateLimits>,
/// Usage budget to apply

#[serde(skip_serializing_if = "Option::is_none")]
pub budget: Option<UsageBudget>
}

#[must_use]
pub fn new(id: impl Into<String>, effect: PolicyEffect) -> Self;

#[must_use]
pub fn with_condition(mut self, condition: PolicyCondition) -> Self;

#[must_use]
pub fn with_scopes(mut self, scopes: ScopeSet) -> Self;

#[must_use]
pub fn matches(&self, request: &PolicyRequest) -> bool;

#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(tag = "type", rename_all = "snake_case")]
pub enum PolicyCondition {
    /// Match on agent ID
    AgentId {
        /// Operator for comparison
        operator: ConditionOperator,
        /// Value to compare against
        value: String,
    },
    /// Match on tenant ID
    TenantId {
        /// Operator for comparison
        operator: ConditionOperator,
        /// Value to compare against
        value: String,
    },
    /// Match on requested scope
    Scope {
        /// Operator for comparison
        operator: ConditionOperator,
        /// Value to compare against
        value: String,
    },
    /// Match on environment
    Environment {
        /// Operator for comparison
        operator: ConditionOperator,
        /// Value to compare against
        value: String,
    },
    /// Match on time of day
    TimeOfDay {
        /// Allowed hours (0-23)
        allowed_hours: Vec<u8>,
    },
    /// Match on day of week
    DayOfWeek {
        /// Allowed days (0=Sunday, 6=Saturday)
        allowed_days: Vec<u8>,
    },
    /// Match on IP address
    IpAddress {
        /// Allowed CIDRs
        allowed_cidrs: Vec<String>,
    },
    /// Match on custom attribute
    Attribute {
        /// Attribute key
        key: String,
        /// Operator for comparison
        operator: ConditionOperator,
        /// Value to compare against
        value: String,
    },
    /// Boolean AND of conditions
    And {
        /// Conditions to AND together
        conditions: Vec<PolicyCondition>,
    },
    /// Boolean OR of conditions
    Or {
        /// Conditions to OR together
        conditions: Vec<PolicyCondition>,
    },
    /// Boolean NOT of condition
    Not {
        /// Condition to negate
        condition: Box<PolicyCondition>,
    },
}

#[must_use]
pub fn evaluate(&self, request: &PolicyRequest) -> bool;

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum ConditionOperator {
    /// Exact equality
    Equals,
    /// Not equal
    NotEquals,
    /// String contains
    Contains,
    /// String starts with
    StartsWith,
    /// String ends with
    EndsWith,
    /// Regex match
    Matches,
    /// In list
    In,
    /// Not in list
    NotIn,
}

#[must_use]
pub fn compare(&self, actual: &str, expected: &str) -> bool;

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum PolicyEffect {
    /// Allow the action
    Allow,
    /// Deny the action
    Deny,
}

#[derive(Debug, Clone)]
pub struct PolicyRequest {
/// Agent ID making the request

pub agent_id: String,
/// Tenant ID

pub tenant_id: String,
/// Requested scope

pub requested_scope: String,
/// Request timestamp

pub timestamp: chrono::DateTime<chrono::Utc>,
/// Environment (e.g., "production", "staging")

pub environment: Option<String>,
/// Client IP address

pub client_ip: Option<String>,
/// Custom attributes

pub attributes: HashMap<String, String>
}

#[must_use]
pub fn new(agent_id: String, tenant_id: String, requested_scope: String) -> Self;

#[must_use]
pub fn with_environment(mut self, env: impl Into<String>) -> Self;

#[must_use]
pub fn with_client_ip(mut self, ip: impl Into<String>) -> Self;

#[must_use]
pub fn with_attribute(mut self, key: impl Into<String>, value: impl Into<String>) -> Self;

#[derive(Debug, Clone)]
pub struct PolicyDecision {
/// The effect (allow/deny)

pub effect: PolicyEffect,
/// ID of the rule that matched (if any)

pub matched_rule: Option<String>,
/// Reason for the decision

pub reason: Option<String>
}

#[must_use]
pub fn is_allowed(&self) -> bool;

#[must_use]
pub fn is_denied(&self) -> bool;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PolicySignature {
/// Signature bytes

pub bytes: Vec<u8>,
/// Algorithm used

pub algorithm: String,
/// Key ID used for signing

pub key_id: String,
/// When the signature was created

pub signed_at: chrono::DateTime<chrono::Utc>
}