# Обновленная конфигурация ACL с группами и odoo
# Добавьте это в configuration.yml вашего Authelia

access_control:
  default_policy: deny

  rules:
    # Admins - полный доступ
    - domain:
        - traefik.ai-impress.com
        - pgadmin.ai-impress.com
        - rabbitmq.ai-impress.com
        - n8n.ai-impress.com
        - portainer.ai-impress.com
        - status.ai-impress.com
        - supabase.ai-impress.com
        - wpp.ai-impress.com
        - odoo.ai-impress.com
      policy: two_factor
      subject:
        - "group:admins"

    # Developers - tech сервисы
    - domain:
        - n8n.ai-impress.com
        - portainer.ai-impress.com
        - traefik.ai-impress.com
        - status.ai-impress.com
        - odoo.ai-impress.com
      policy: two_factor
      subject:
        - "group:developers"

    # Analysts - аналитика и данные
    - domain:
        - pgadmin.ai-impress.com
        - status.ai-impress.com
        - odoo.ai-impress.com
      policy: two_factor
      subject:
        - "group:analysts"

    # Users - базовый доступ
    - domain:
        - wiki.ai-impress.com
        - status.ai-impress.com
      policy: one_factor
      subject:
        - "group:users"

    # Odoo database manager - публичный доступ (как было)
    - domain: odoo.ai-impress.com
      resources:
        - "^/web/database.*$"
      policy: bypass
