{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "urn:ci-app-access-policy:v1",
  "title": "CI App Access Policy v1",
  "description": "Private authorization policy. Evaluate only against trusted server context. A per-user cap below min_role denies that user; a global max_role below min_role invalidates the policy.",
  "type": "object",
  "additionalProperties": false,
  "required": ["schema", "app_id", "revision"],
  "$defs": {
    "role": {"enum": ["guest", "customer", "developer", "admin"]},
    "subject": {
      "type": "string", "pattern": "\\S",
      "not": {"pattern": "[\\u0000-\\u001F\\u007F]"}
    }
  },
  "properties": {
    "schema": {"const": "ci-app-access-policy/v1"},
    "app_id": {"$ref": "#/$defs/subject"},
    "revision": {"type": "integer", "minimum": 1, "maximum": 9007199254740991},
    "min_role": {"$ref": "#/$defs/role"},
    "max_role": {"$ref": "#/$defs/role"},
    "allowed_users": {
      "type": "array", "uniqueItems": true,
      "items": {"$ref": "#/$defs/subject"}
    },
    "user_max_roles": {
      "type": "object", "propertyNames": {"$ref": "#/$defs/subject"},
      "additionalProperties": {"$ref": "#/$defs/role"}
    }
  },
  "allOf": [
    {
      "if": {"required": ["min_role"], "properties": {"min_role": {"const": "customer"}}},
      "then": {"properties": {"max_role": {"enum": ["customer", "developer", "admin"]}}}
    },
    {
      "if": {"required": ["min_role"], "properties": {"min_role": {"const": "developer"}}},
      "then": {"properties": {"max_role": {"enum": ["developer", "admin"]}}}
    },
    {
      "if": {"required": ["min_role"], "properties": {"min_role": {"const": "admin"}}},
      "then": {"properties": {"max_role": {"const": "admin"}}}
    }
  ]
}