from simorgh.apps.modules.registry import CapabilitySpec, FeatureSpec, ModuleManifest, register_module

register_module(
    ModuleManifest(
        name="iam",
        version=1,
        domain="platform",
        label_key="iam.module_label",
        description="IAM — role-based access control, permissions, and authentication policies",
        capabilities=(
            CapabilitySpec(slug="access", label_key="iam.capabilities.access",
                          description="Access control and permissions", icon="lock"),
            CapabilitySpec(slug="auth", label_key="iam.capabilities.auth",
                          description="Authentication policies", icon="shield"),
        ),
        features=(
            FeatureSpec(code="access.role_management", label_key="iam.features.role_management", scope="tenant", default_enabled=True, is_always_on=True, is_platform_internal=True, description="Create and manage IAM roles"),
            FeatureSpec(code="access.permission_registry", label_key="iam.features.permission_registry", scope="tenant", default_enabled=True, is_always_on=True, is_platform_internal=True, description="Central permission registry auto-synced from modules"),
            FeatureSpec(code="auth.mfa", label_key="iam.features.mfa", scope="tenant", description="Multi-factor authentication enforcement"),
            FeatureSpec(code="auth.sso", label_key="iam.features.sso", scope="tenant", description="Single Sign-On with SAML/OIDC"),
        ),
    )
)