# secrets-engine-prod — production stage role policy.
#
# Scope: apply approved PRODUCTION metadata (ACL policies + approle roles) and
# write approved lane values for provisioning. Deliberately NARROW:
#   - no root / sudo
#   - no sys/* administration beyond its own se-prod-* ACL policies
#   - no identity/* administration
#   - no auth/token administration
#   - cannot reach into build/ or test/ prefixes
#
# Production raw-value READ stays gated: this role can write a value during an
# approved provisioning step, but broad read of arbitrary prod paths is denied.
# Consumers read their own lane through the narrow se-prod-<lane> consumer policy.

# Apply approved production lane values (provisioning) and metadata.
# Owner-scoped prod lanes (e.g. whynot-design/...) — NOT under build/ or test/.
path "secret/data/+/*" {
  capabilities = ["create", "update", "patch"]
}
path "secret/metadata/+/*" {
  capabilities = ["create", "read", "update", "list"]
}

# Manage only the prod consumer policies this role owns.
path "sys/policies/acl/se-prod-*" {
  capabilities = ["create", "read", "update", "delete"]
}

# Exact exception for SECRETS-WP-0004 auth-capability lane.
path "sys/policies/acl/warden-sign" {
  capabilities = ["create", "read", "update", "delete"]
}

# Manage prod approle roles only.
path "auth/approle/role/se-prod-*" {
  capabilities = ["create", "read", "update", "delete"]
}
path "auth/approle/role/se-prod-*/role-id" {
  capabilities = ["read"]
}
path "auth/approle/role/se-prod-*/secret-id" {
  capabilities = ["create", "update"]
}

# Exact exception for SECRETS-WP-0004 auth-capability lane.
path "auth/approle/role/warden-sign" {
  capabilities = ["create", "read", "update", "delete"]
}
path "auth/approle/role/warden-sign/role-id" {
  capabilities = ["read"]
}
path "auth/approle/role/warden-sign/secret-id" {
  capabilities = ["create", "update"]
}

# Hard denials — production appliers must not become broad admins.
path "secret/data/build/*" { capabilities = ["deny"] }
path "secret/data/test/*"  { capabilities = ["deny"] }
path "sys/policies/acl/secrets-engine-*" { capabilities = ["deny"] }  # can't edit stage roles
path "auth/token/*"        { capabilities = ["deny"] }
path "identity/*"          { capabilities = ["deny"] }
path "sys/auth/*"          { capabilities = ["deny"] }
path "sys/mounts/*"        { capabilities = ["deny"] }