{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://pdf2html.invalid/quality/fixtures/authz-web/principals.schema.json",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "schemaVersion",
    "fixtureClock",
    "policy",
    "principals",
    "objects",
    "origins",
    "credentials"
  ],
  "properties": {
    "schemaVersion": {
      "const": 2
    },
    "fixtureClock": {
      "$ref": "#/$defs/instant"
    },
    "policy": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "apiVersion",
        "allowedOrigin",
        "idempotencyRetentionSeconds",
        "accessLifetimeSeconds",
        "refreshLifetimeSeconds",
        "rateOperations"
      ],
      "properties": {
        "apiVersion": {
          "const": "2026-08-23"
        },
        "allowedOrigin": {
          "const": "https://tools.press.zone"
        },
        "idempotencyRetentionSeconds": {
          "const": 259200
        },
        "accessLifetimeSeconds": {
          "const": 900
        },
        "refreshLifetimeSeconds": {
          "const": 2592000
        },
        "rateOperations": {
          "type": "array",
          "minItems": 12,
          "maxItems": 12,
          "uniqueItems": true,
          "items": {
            "enum": [
              "registration",
              "login",
              "upload_creation",
              "upload_completion",
              "conversion_acceptance",
              "checkout",
              "download_signing",
              "stripe_webhook",
              "worker_claim",
              "worker_heartbeat",
              "worker_completion",
              "admin_mutation"
            ]
          }
        }
      }
    },
    "principals": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "userA",
        "userB",
        "admin",
        "expired",
        "disabled"
      ],
      "properties": {
        "userA": {
          "$ref": "#/$defs/customer"
        },
        "userB": {
          "$ref": "#/$defs/customer"
        },
        "admin": {
          "$ref": "#/$defs/admin"
        },
        "expired": {
          "$ref": "#/$defs/customer"
        },
        "disabled": {
          "$ref": "#/$defs/customer"
        }
      }
    },
    "objects": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "conversionA",
        "conversionB",
        "uploadA",
        "uploadB",
        "purchaseA",
        "accountA"
      ],
      "properties": {
        "conversionA": {
          "$ref": "#/$defs/object"
        },
        "conversionB": {
          "$ref": "#/$defs/object"
        },
        "uploadA": {
          "$ref": "#/$defs/object"
        },
        "uploadB": {
          "$ref": "#/$defs/object"
        },
        "purchaseA": {
          "$ref": "#/$defs/object"
        },
        "accountA": {
          "$ref": "#/$defs/object"
        }
      }
    },
    "origins": {
      "type": "array",
      "minItems": 7,
      "uniqueItems": true,
      "contains": {
        "const": "https://tools.press.zone"
      },
      "items": {
        "type": "string",
        "minLength": 4,
        "maxLength": 256
      }
    },
    "credentials": {
      "type": "object",
      "minProperties": 1,
      "additionalProperties": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "principal",
          "parserState"
        ],
        "properties": {
          "principal": {
            "enum": [
              "userA",
              "userB",
              "admin",
              "expired",
              "disabled"
            ]
          },
          "parserState": {
            "enum": [
              "valid",
              "expired",
              "revoked"
            ]
          }
        }
      }
    }
  },
  "$defs": {
    "instant": {
      "type": "string",
      "format": "date-time",
      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\\.[0-9]{3}Z$"
    },
    "uuid": {
      "type": "string",
      "format": "uuid",
      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
    },
    "csrf": {
      "oneOf": [
        {
          "type": "null"
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "generation",
            "issuedAt",
            "tokenRef",
            "hashRef"
          ],
          "properties": {
            "generation": {
              "type": "integer",
              "minimum": 1
            },
            "issuedAt": {
              "$ref": "#/$defs/instant"
            },
            "tokenRef": {
              "type": "string",
              "pattern": "^csrf_[a-z0-9_]+$"
            },
            "hashRef": {
              "type": "string",
              "pattern": "^sha256:[a-z0-9_]+$"
            }
          }
        }
      ]
    },
    "session": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "id",
        "state",
        "expiresAt",
        "version",
        "csrf"
      ],
      "properties": {
        "id": {
          "type": "string",
          "pattern": "^ses_[a-z0-9]{16,64}$"
        },
        "state": {
          "enum": [
            "active",
            "expired",
            "revoked"
          ]
        },
        "expiresAt": {
          "$ref": "#/$defs/instant"
        },
        "version": {
          "type": "integer",
          "minimum": 1
        },
        "csrf": {
          "$ref": "#/$defs/csrf"
        }
      }
    },
    "principal": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "id",
        "role",
        "status",
        "session"
      ],
      "properties": {
        "id": {
          "$ref": "#/$defs/uuid"
        },
        "role": {
          "enum": [
            "customer",
            "admin"
          ]
        },
        "status": {
          "enum": [
            "active",
            "disabled",
            "deleted"
          ]
        },
        "session": {
          "$ref": "#/$defs/session"
        }
      }
    },
    "customer": {
      "allOf": [
        {
          "$ref": "#/$defs/principal"
        },
        {
          "properties": {
            "role": {
              "const": "customer"
            }
          }
        }
      ]
    },
    "admin": {
      "allOf": [
        {
          "$ref": "#/$defs/principal"
        },
        {
          "properties": {
            "role": {
              "const": "admin"
            }
          }
        }
      ]
    },
    "object": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "kind",
        "id",
        "ownerId"
      ],
      "properties": {
        "kind": {
          "enum": [
            "conversion",
            "upload",
            "purchase",
            "account"
          ]
        },
        "id": {
          "$ref": "#/$defs/uuid"
        },
        "ownerId": {
          "$ref": "#/$defs/uuid"
        }
      }
    }
  }
}