{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://colloq.dev/spec/colloq-authorization-v0.schema.json",
  "title": "Colloq Endpoint Authorization Policy v0",
  "description": "A local allow-list binding authenticated endpoint identities to exact Colloq roles and plan identities.",
  "type": "object",
  "additionalProperties": false,
  "required": ["colloq_authorization", "rules"],
  "properties": {
    "colloq_authorization": {
      "const": "0.1.0"
    },
    "rules": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["endpoint_identity", "role", "plan"],
        "properties": {
          "endpoint_identity": {
            "$ref": "#/$defs/endpoint_id"
          },
          "role": {
            "$ref": "#/$defs/id"
          },
          "plan": {
            "$ref": "#/$defs/sha256"
          }
        }
      }
    }
  },
  "$defs": {
    "endpoint_id": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$"
    },
    "id": {
      "type": "string",
      "pattern": "^[a-z][a-z0-9_.-]*$"
    },
    "sha256": {
      "type": "string",
      "pattern": "^sha256:[0-9a-f]{64}$"
    }
  }
}