pub trait SecurityCore: Send + Sync {
    /// Authorize an action. Deny-by-default.
    fn authorize(&self, action: &Action) -> Result<Permit>;

    /// Check if a filesystem path is allowed
    fn check_path(&self, path: &std::path::Path) -> Result<()>;

    /// Generate a one-time pairing code
    fn generate_pairing_code(&self) -> Result<String>;

    /// Verify a pairing code and return device identity
    fn verify_pairing_code(&self, code: &str) -> Result<Identity>;

    /// List all paired devices
    fn list_devices(&self) -> Result<Vec<PairedDevice>>;

    /// Remove a paired device by device_id (exact or prefix match)
    fn remove_device(&self, device_id_prefix: &str) -> Result<PairedDevice>;
}

fn authorize(&self, action: &Action) -> Result<Permit>

fn check_path(&self, path: &std::path::Path) -> Result<()>

fn generate_pairing_code(&self) -> Result<String>

fn verify_pairing_code(&self, code: &str) -> Result<Identity>

fn list_devices(&self) -> Result<Vec<PairedDevice>>

fn remove_device(&self, device_id_prefix: &str) -> Result<PairedDevice>

pub struct NoopSecurity;

use oneclaw_core::security::{SecurityCore, NoopSecurity, Action, ActionKind};

let security = NoopSecurity;
let action = Action {
    kind: ActionKind::Read,
    resource: "/some/path".into(),
    actor: "test".into(),
};
let permit = security.authorize(&action).unwrap();
assert!(permit.granted); // Always true

pub struct DefaultSecurity {
    path_guard: PathGuard,
    pairing: PairingManager,
    paired_devices: Mutex<HashSet<String>>,
    pairing_required: bool,
    registry_path: Option<PathBuf>,
    persistence: Option<SqliteSecurityStore>,
}

pub fn new(
    workspace: impl Into<PathBuf>,
    workspace_only: bool,
    pairing_required: bool,
    pairing_code_ttl_seconds: i64,
) -> Self

pub fn production(workspace: impl Into<PathBuf>) -> Self

pub fn development(workspace: impl Into<PathBuf>) -> Self

pub fn with_registry_path(mut self, path: impl Into<PathBuf>) -> Self

pub fn with_persistence(mut self, store: SqliteSecurityStore) -> Self

use oneclaw_core::security::{DefaultSecurity, SqliteSecurityStore};
use std::path::PathBuf;

// Production configuration
let workspace = PathBuf::from("/var/oneclaw/workspace");
let security = DefaultSecurity::production(workspace);

// With SQLite persistence
let store = SqliteSecurityStore::new("/var/oneclaw/security.db")?;
let security = DefaultSecurity::production("/var/oneclaw/workspace")
    .with_persistence(store);

// Development configuration (no pairing required)
let security = DefaultSecurity::development("./workspace");

pub struct Action {
    pub kind: ActionKind,
    pub resource: String,
    pub actor: String,
}

pub enum ActionKind {
    Read,
    Write,
    Execute,
    Network,
    PairDevice,
}

pub struct Permit {
    pub granted: bool,
    pub reason: String,
}

pub struct Identity {
    pub device_id: String,
    pub paired_at: chrono::DateTime<chrono::Utc>,
}

pub struct PairedDevice {
    pub device_id: String,
    pub paired_at: chrono::DateTime<chrono::Utc>,
    pub label: String,
    pub last_seen: chrono::DateTime<chrono::Utc>,
}