# L0 Policy Example
L0_OWNER:
  allow: [ALL]
L0_CASHIER:
  allow: [POS, INVOICE]
L0_VIEWER:
  readonly: true

# L1 Policy Example
L1_OWN_MGR:
  allow: [FIN.*, INV.*, HR.*, POS]
L1_FIN_MGR:
  allow: [FIN.*, INVOICE, REPORT]
L1_INV_MGR:
  allow: [STOCK, PURCHASE]

# L2 Policy Example dengan SoD
L2_ADM_SYS:
  allow: [DEPLOY, BACKUP, MONITOR]
  deny: [FIN.*, HR.*]  # SoD enforcement

L2_FIN_AP:
  allow: [PAYMENT]
  deny: [ACC-MGR]  # Tidak boleh approve sendiri

L2_ACC_MGR:
  allow: [JOURNAL, REPORT, APPROVE]
  deny: [FIN-AP]  # Tidak boleh input pembayaran

# L3 Policy dengan Domain
L3_OWN_MGR_HLD:
  allow: [ALL]
  scope: HOLDING

L3_CONS_MGR:
  allow: [CONSOLIDATION, REPORTING]
  scope: HOLDING  # Akses cross-entity

# L4 Policy dengan Global Scope
L4_BOARD_CXO:
  allow: [GLOBAL.REPORTS, DASHBOARD, KPI]
  scope: GLOBAL

L4_IT_SYS_GLOBAL:
  allow: [IAM, SSO, OPA, ENCRYPTION]
  deny: [FIN.*, HR.*]
  scope: GLOBAL

L4_AUD_EXTERNAL:
  readonly: true
  scope: GLOBAL
  audit_trail: required

-- merchants table
ALTER TABLE merchants ADD COLUMN business_level 
  ENUM('L0', 'L1', 'L2', 'L3', 'L4') NOT NULL DEFAULT 'L1'
  COMMENT 'Business size level';

-- roles table
ALTER TABLE roles ADD COLUMN available_levels 
  VARCHAR(32) NOT NULL DEFAULT 'L1,L2,L3,L4'
  COMMENT 'Comma-separated business levels where this role is available';

// Load roles based on merchant's business level
func (s *service) GetAvailableRoles(merchantID uint) ([]Role, error) {
    var merchant Merchant
    if err := s.db.First(&merchant, merchantID).Error; err != nil {
        return nil, err
    }
    
    var roles []Role
    query := s.db.Where("available_levels LIKE ?", "%"+merchant.BusinessLevel+"%")
    if err := query.Find(&roles).Error; err != nil {
        return nil, err
    }
    
    return roles, nil
}

# policy.csv (L2 example)
p, L2_ADM-SYS, /api/*, DEPLOY
p, L2_ADM-SYS, /api/*, BACKUP
p, L2_FIN-AP, /api/payment/*, WRITE
p, L2_ACC-MGR, /api/journal/*, APPROVE

# grouping.csv (hierarchy)
g, alice, L2_ADM-SYS
g, bob, L2_FIN-AP
g, charlie, L2_ACC-MGR

# domain.csv (L3 example)
p, L3_FIN-MGR@ENT-01, ENT-01, /api/finance/*, *
p, L3_FIN-MGR@ENT-02, ENT-02, /api/finance/*, *
p, L3_CONS-MGR@HOLDING, *, /api/consolidation/*, *

# Test SoD enforcement
curl -X POST http://localhost:8080/api/rbac/validate \
  -H "Content-Type: application/json" \
  -d '{
    "user_id": 123,
    "roles": ["L2_FIN-AP", "L2_ACC-MGR"]
  }'

# Expected response:
# {
#   "valid": false,
#   "error": "SoD violation: L2_FIN-AP cannot be combined with L2_ACC-MGR"
# }

func TestSoDEnforcement(t *testing.T) {
    e, _ := casbin.NewEnforcer("model.conf", "policy.csv")
    
    // Test: L2_FIN-AP should NOT access L2_ACC-MGR endpoints
    ok, _ := e.Enforce("bob", "L2_FIN-AP", "/api/journal/approve", "POST")
    assert.False(t, ok, "L2_FIN-AP should not approve journal")
    
    // Test: L2_ACC-MGR CAN approve journal
    ok, _ = e.Enforce("charlie", "L2_ACC-MGR", "/api/journal/approve", "POST")
    assert.True(t, ok, "L2_ACC-MGR should approve journal")
}