# Styrene Device Agent Authorization Configuration
#
# This file defines which Reticulum identities are authorized to send RPC
# commands to this device agent.
#
# SECURITY: Protect this file (chmod 600) and ensure only authorized operators
# have their identity hashes listed here.

version: 1

# List of authorized identities
identities:
  # Example operator 1 - Full administrative access
  - hash: "REPLACE_WITH_OPERATOR_IDENTITY_HASH"
    name: "Primary Operator"
    description: "Main administrative user"
    permissions:
      - status_request  # Can query device status
      - exec           # Can execute commands
      - reboot         # Can reboot device
      - update_config  # Can update configuration

  # Example operator 2 - Read-only monitoring
  - hash: "REPLACE_WITH_MONITOR_IDENTITY_HASH"
    name: "Monitoring User"
    description: "Read-only status monitoring"
    permissions:
      - status_request  # Can only query status

  # Example operator 3 - Limited execution permissions
  - hash: "REPLACE_WITH_LIMITED_IDENTITY_HASH"
    name: "Limited Operator"
    description: "Can execute commands but not reboot"
    permissions:
      - status_request
      - exec

# Default policy for unknown identities
default_policy: deny  # deny | allow (recommend: deny)

# Logging configuration
audit_logging:
  enabled: true
  log_allowed: true     # Log successful authorization checks
  log_denied: true      # Log denied access attempts
  log_path: /var/log/styrene-agent/auth.log

# Command allowlist (if using exec permission)
# Only these commands can be executed via RPC
command_allowlist:
  - echo
  - ls
  - cat
  - df
  - free
  - uptime
  - systemctl status
  - journalctl

# Security settings
security:
  max_command_timeout: 30  # Maximum execution time for commands (seconds)
  validate_command_args: true  # Sanitize command arguments
  block_shell_metacharacters: true  # Prevent command injection

# Notes:
# 1. Get operator identity hash: rnstatus -i
# 2. Reload config: systemctl reload styrene-agent
# 3. Test authorization: Check /var/log/styrene-agent/auth.log
