"""DMS Phase 12 IAM permission definitions — Audit & Observability."""

from simorgh.apps.iam.registry import register_permission

PERM_AUDIT_VIEW = "dms.audit.view"
PERM_ACCESS_LOG_VIEW = "dms.access_log.view"
PERM_SECURITY_EVENTS_VIEW = "dms.security_events.view"


def register_all() -> None:
    register_permission(
        PERM_AUDIT_VIEW,
        label="DMS: View Document Audit Log",
        description="View the full lifecycle audit trail for DMS documents.",
    )
    register_permission(
        PERM_ACCESS_LOG_VIEW,
        label="DMS: View Access Logs",
        description="View document access logs (views, downloads, previews).",
    )
    register_permission(
        PERM_SECURITY_EVENTS_VIEW,
        label="DMS: View Security Events",
        description="View security incident events for DMS documents.",
    )