// Package fs permission registry.
// This is the SINGLE SOURCE OF TRUTH for all filesystem permissions.
// Every file and directory permission in the 9P tree is declared here.
// No permission literals should appear anywhere else.
package fs

import "os"

// Path constants for the filesystem namespace.
//
// Paths ending in "/" are directories (used as route prefixes).
// Paths without trailing "/" are scoped entries within a parent.
//
// Template variables:
//
//	{id}   — session ID (dynamic, matches any session)
//	{file} — file name within a session directory
const (
	PathRoot        = "/"
	PathSessions    = "/session/"
	PathElevate     = "/elevate/"
	PathSessionDir  = "session/{id}"
	PathTools       = "t/"
	PathSessionFile = "session/{id}/{file}"
)

// Perm declares permissions for a filesystem node.
//   - DirMode: permission reported in 9P stat for the directory itself.
//   - FileMode: default permission for files created/listed in this directory.
//   - Files: per-file permission overrides (file name → mode).
type Perm struct {
	DirMode  os.FileMode
	FileMode os.FileMode
	Files    map[string]os.FileMode
}

// Perms is the permission registry. To find the permission for any path,
// look it up here.
var Perms = map[string]Perm{
	PathRoot: {
		DirMode:  0755,
		FileMode: 0444,
		Files: map[string]os.FileMode{
			"backends": 0444,
			"help":     0444,
		},
	},
	PathElevate: {
		DirMode:  0755,
		FileMode: 0666,
		Files: map[string]os.FileMode{
			"policy":  0666,
			"pending": 0755,
		},
	},
	PathSessions: {
		DirMode:  0755,
		FileMode: 0444,
		Files: map[string]os.FileMode{
			"new":     0666,
			"idx":     0444,
			"ls":      0555,
			"kill":    0555,
			"sh":      0550,
			"b":       0555,
			"bfg":     0555,
			"bbg":     0555,
			"cleanup": 0555,
		},
	},
	PathSessionDir: {DirMode: 0755},
	PathTools:      {DirMode: 0755, FileMode: 0755},
	PathSessionFile: {
		Files: map[string]os.FileMode{
			"elevate":      0666,
			"plan":         0666,
			"ctl":          0666,
			"prompt":       0666,
			"fifo.in":      0222,
			"fifo.out":     0444,
			"chat":         0444,
			"offset":       0444,
			"cfg":          0666,
			"state":        0444,
			"statewait":    0444,
			"usage":        0444,
			"cost":         0444,
			"ctxsz":        0444,
			"models":       0444,
			"systemprompt": 0444,
			"env":          0444,
			"tail":         0555,
			"prompt.prev":  0444,
			"context":      0444,
			"toolsrv.loaded": 0444,
			"toolsrv.rev":    0444,
			"tools":        0666,
		},
	},
}

// Structural permissions — invariants of the Tree type itself.
const (
	PermIdx      os.FileMode = 0444 // synthetic index files are always read-only
	PermChildDir os.FileMode = 0555 // mounted child directories are always rx
)

// OS-level directory creation mode (for os.MkdirAll of backing dirs on disk).
const PermMkdir os.FileMode = 0755

// Private directory creation mode (e.g. sessions state dir).
const PermMkdirPrivate os.FileMode = 0700