# M5 权限脱敏安全模型 (v2.1：新增 order_audit 权限，绑定 SCENE_AUDIT_ORDER)
# 区分模板编辑管理员权限、页面访问权限、敏感字段掩码渲染规则；前端渲染引擎自动读取执行。
securityModel:
  globalConfig:
    authMode: oauth2_jwt
    auditEnable: true

  principals:
    - principalId: normal_user
      desc: C端普通消费者
    - principalId: backend_admin
      desc: 后台运营管理员

  functionPermissions:
    - permId: customer_create
      bindScene: SCENE_CREATE_CUSTOMER
      allowPrincipals: [backend_admin]
    - permId: order_create
      bindScene: SCENE_CREATE_ORDER
      allowPrincipals: [normal_user, backend_admin]
    - permId: order_modify_addr
      bindScene: SCENE_MODIFY_ORDER_ADDR
      allowPrincipals: [normal_user, backend_admin]
    - permId: order_cancel
      bindScene: SCENE_CANCEL_ORDER
      allowPrincipals: [normal_user, backend_admin]
    - permId: order_audit
      bindScene: SCENE_AUDIT_ORDER
      allowPrincipals: [normal_user, backend_admin]
    - permId: customer_modify
      bindScene: SCENE_MODIFY_CUSTOMER
      allowPrincipals: [backend_admin]
    - permId: product_create
      bindScene: SCENE_CREATE_PRODUCT
      allowPrincipals: [backend_admin]
    - permId: product_modify_price
      bindScene: SCENE_MODIFY_PRODUCT_PRICE
      allowPrincipals: [backend_admin]
    - permId: employee_create
      bindScene: SCENE_CREATE_EMPLOYEE
      allowPrincipals: [backend_admin]
    - permId: employee_modify
      bindScene: SCENE_MODIFY_EMPLOYEE
      allowPrincipals: [backend_admin]

  maskRules:
    contactPhone: "{first3}****{last4}"
    receiverPhone: "{first3}****{last4}"

  encryptRules:
    storageEncrypt: [contactPhone, receiverPhone]