{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://auth.xindu.xyz/schema/auth-v1.json",
  "title": "CYBER_NETWORK_AUTHORIZATION",
  "type": "object",
  "required": ["doc", "issuer", "subject", "grant", "validity", "extensions", "signature"],
  "properties": {
    "doc": {
      "type": "object",
      "required": ["id", "type", "document_class", "schema", "version", "status", "classification", "created_at"],
      "properties": {
        "id": {"type": "string", "pattern": "^CYB-NODE-\\d{4}-\\d{6}$"},
        "type": {"const": "CYBER_NETWORK_AUTHORIZATION"},
        "document_class": {"const": "NODE_CREDENTIAL"},
        "schema": {"const": "https://auth.xindu.xyz/schema/auth-v1.json"},
        "version": {"const": "1.0"},
        "status": {"const": "active"},
        "classification": {"const": "RESTRICTED"},
        "created_at": {"type": "string", "format": "date-time"}
      }
    },
    "issuer": {
      "type": "object",
      "required": ["name", "authority", "kid", "certificate_pem", "certificate_chain_pem",
                   "certificate_chain_fingerprint_sha256", "certificate_fingerprint_sha256",
                   "root_certificate_fingerprint_sha256", "public_key_pem"],
      "properties": {
        "name": {"const": "Xindu"},
        "authority": {"const": "CYBER ROOT AUTHORITY"},
        "kid": {"const": "xindu-netca-g1-2026-01"},
        "certificate_chain_pem": {"type": "array", "minItems": 2, "maxItems": 2,
                                  "items": {"type": "string"}}
      }
    },
    "subject": {
      "type": "object",
      "required": ["type", "role", "name", "node_id", "public_key_pem",
                   "public_key_fingerprint_sha256"],
      "properties": {
        "type": {"const": "AUTHORIZED_NODE"},
        "role": {"const": "network_authorized_node"}
      }
    },
    "grant": {
      "type": "object",
      "required": ["scope", "segments", "permissions"],
      "properties": {
        "scope": {"const": "net.access.network_wide"},
        "permissions": {"type": "array", "items": {"type": "string"},
                        "contains": {"const": "join_network"}}
      }
    },
    "validity": {
      "type": "object",
      "required": ["issued_at", "not_before", "not_after", "duration"],
      "properties": {
        "duration": {"const": "P7D"}
      }
    },
    "extensions": {
      "type": "object",
      "required": ["audience", "nonce", "admission", "revocation"],
      "properties": {
        "admission": {
          "type": "object",
          "required": ["method", "statement", "policy_ref"],
          "properties": {
            "method": {"const": "local-only"},
            "policy_ref": {"const": "https://auth.xindu.xyz/policies/node-enrollment"}
          }
        }
      }
    },
    "signature": {
      "type": "object",
      "required": ["alg", "canon", "kid", "chain_fingerprint_sha256", "signed_at", "value_b64"],
      "properties": {
        "alg": {"const": "Ed25519"},
        "canon": {"const": "JCS"},
        "kid": {"const": "xindu-netca-g1-2026-01"}
      }
    }
  }
}