@spec check(atom(), map(), keyword()) :: :ok | {:error, term()}

Authorizes a protected sync read or write subject for the given request context.

Supported capabilities are :sync_read and :sync_write.

opts[:context] defaults to an empty Parrhesia.API.RequestContext, which means protected subjects will fail with {:error, :auth_required} until authenticated pubkeys are present.

Local callers bypass ACL enforcement entirely. ACL is intended to protect external sync traffic, not trusted in-process calls.

@spec grant(
  map(),
  keyword()
) :: :ok | {:error, term()}

Persists an ACL rule.

A typical rule looks like:

%{
  principal_type: :pubkey,
  principal: "...64 hex chars...",
  capability: :sync_read,
  match: %{"kinds" => [5000], "#r" => ["tribes.accounts.user"]}
}

@spec list(keyword()) :: {:ok, [map()]} | {:error, term()}

Lists persisted ACL rules.

Supported filters are:

• :principal_type
• :principal
• :capability

@spec protected_read?(map()) :: boolean()

Returns true when a filter overlaps the configured protected read surface.

@spec protected_read_filters() :: {:ok, [map()]} | {:error, term()}

Returns the configured protected read filters.

@spec protected_write?(map()) :: boolean()

Returns true when an event matches the configured protected write surface.

@spec revoke(
  map(),
  keyword()
) :: :ok | {:error, term()}

Deletes ACL rules matching the given selector.

The selector is passed through to the configured storage adapter, which typically accepts an id-based selector such as %{id: rule_id}.