@prefix iam: <https://ggen.ai/ontology/iam#> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
@prefix dcterms: <http://purl.org/dc/terms/> .

# Ontology Definition
iam: a owl:Ontology ;
    dcterms:title "Identity & Access Management Ontology" ;
    dcterms:description "Enterprise IAM with OAuth2, SAML, OIDC, RBAC, ABAC, MFA, and audit logging" ;
    dcterms:created "2025-01-08"^^xsd:date ;
    owl:versionInfo "1.0.0" .

# ============================================================================
# CORE CLASSES - Identity
# ============================================================================

iam:Identity a owl:Class ;
    rdfs:label "Identity" ;
    rdfs:comment "Digital identity (user, service account, machine)" .

iam:User a owl:Class ;
    rdfs:subClassOf iam:Identity ;
    rdfs:label "User" ;
    rdfs:comment "Human user identity" .

iam:ServiceAccount a owl:Class ;
    rdfs:subClassOf iam:Identity ;
    rdfs:label "Service Account" ;
    rdfs:comment "Non-human service identity" .

iam:Group a owl:Class ;
    rdfs:label "Group" ;
    rdfs:comment "Collection of identities" .

iam:OrganizationUnit a owl:Class ;
    rdfs:label "Organization Unit" ;
    rdfs:comment "Organizational structure unit" .

# ============================================================================
# AUTHENTICATION CLASSES
# ============================================================================

iam:Authentication a owl:Class ;
    rdfs:label "Authentication" ;
    rdfs:comment "Authentication mechanism" .

iam:PasswordAuthentication a owl:Class ;
    rdfs:subClassOf iam:Authentication ;
    rdfs:label "Password Authentication" ;
    rdfs:comment "Username and password authentication" .

iam:OAuth2 a owl:Class ;
    rdfs:subClassOf iam:Authentication ;
    rdfs:label "OAuth2" ;
    rdfs:comment "OAuth 2.0 authorization framework" .

iam:OpenIDConnect a owl:Class ;
    rdfs:subClassOf iam:OAuth2 ;
    rdfs:label "OpenID Connect (OIDC)" ;
    rdfs:comment "OpenID Connect authentication layer" .

iam:SAML a owl:Class ;
    rdfs:subClassOf iam:Authentication ;
    rdfs:label "SAML" ;
    rdfs:comment "Security Assertion Markup Language" .

iam:LDAP a owl:Class ;
    rdfs:subClassOf iam:Authentication ;
    rdfs:label "LDAP" ;
    rdfs:comment "Lightweight Directory Access Protocol" .

iam:Kerberos a owl:Class ;
    rdfs:subClassOf iam:Authentication ;
    rdfs:label "Kerberos" ;
    rdfs:comment "Kerberos authentication protocol" .

iam:BiometricAuthentication a owl:Class ;
    rdfs:subClassOf iam:Authentication ;
    rdfs:label "Biometric Authentication" ;
    rdfs:comment "Fingerprint, face, or voice authentication" .

# ============================================================================
# MULTI-FACTOR AUTHENTICATION CLASSES
# ============================================================================

iam:MultiFactorAuthentication a owl:Class ;
    rdfs:label "Multi-Factor Authentication (MFA)" ;
    rdfs:comment "Multi-factor authentication requirement" .

iam:TOTP a owl:Class ;
    rdfs:subClassOf iam:MultiFactorAuthentication ;
    rdfs:label "Time-based OTP (TOTP)" ;
    rdfs:comment "Time-based one-time password" .

iam:SMS_MFA a owl:Class ;
    rdfs:subClassOf iam:MultiFactorAuthentication ;
    rdfs:label "SMS MFA" ;
    rdfs:comment "SMS-based authentication code" .

iam:HardwareToken a owl:Class ;
    rdfs:subClassOf iam:MultiFactorAuthentication ;
    rdfs:label "Hardware Token" ;
    rdfs:comment "Physical security key (YubiKey, U2F)" .

iam:PushNotification a owl:Class ;
    rdfs:subClassOf iam:MultiFactorAuthentication ;
    rdfs:label "Push Notification" ;
    rdfs:comment "Mobile push notification approval" .

iam:WebAuthn a owl:Class ;
    rdfs:subClassOf iam:MultiFactorAuthentication ;
    rdfs:label "WebAuthn" ;
    rdfs:comment "Web Authentication API (FIDO2)" .

# ============================================================================
# PASSWORDLESS AUTHENTICATION CLASSES
# ============================================================================

iam:PasswordlessAuthentication a owl:Class ;
    rdfs:label "Passwordless Authentication" ;
    rdfs:comment "Passwordless login mechanism" .

iam:MagicLink a owl:Class ;
    rdfs:subClassOf iam:PasswordlessAuthentication ;
    rdfs:label "Magic Link" ;
    rdfs:comment "Email-based magic link login" .

iam:PasskeyAuthentication a owl:Class ;
    rdfs:subClassOf iam:PasswordlessAuthentication ;
    rdfs:label "Passkey Authentication" ;
    rdfs:comment "Platform passkey (Touch ID, Face ID)" .

# ============================================================================
# AUTHORIZATION CLASSES - RBAC
# ============================================================================

iam:Authorization a owl:Class ;
    rdfs:label "Authorization" ;
    rdfs:comment "Authorization mechanism" .

iam:RBAC a owl:Class ;
    rdfs:subClassOf iam:Authorization ;
    rdfs:label "Role-Based Access Control" ;
    rdfs:comment "RBAC authorization model" .

iam:Role a owl:Class ;
    rdfs:label "Role" ;
    rdfs:comment "Set of permissions assigned to users" .

iam:Permission a owl:Class ;
    rdfs:label "Permission" ;
    rdfs:comment "Permission to perform action on resource" .

iam:Privilege a owl:Class ;
    rdfs:label "Privilege" ;
    rdfs:comment "Specific privilege or capability" .

# ============================================================================
# AUTHORIZATION CLASSES - ABAC
# ============================================================================

iam:ABAC a owl:Class ;
    rdfs:subClassOf iam:Authorization ;
    rdfs:label "Attribute-Based Access Control" ;
    rdfs:comment "ABAC authorization model" .

iam:Attribute a owl:Class ;
    rdfs:label "Attribute" ;
    rdfs:comment "Subject, resource, or environment attribute" .

iam:Policy a owl:Class ;
    rdfs:label "Policy" ;
    rdfs:comment "Access control policy" .

iam:PolicyRule a owl:Class ;
    rdfs:label "Policy Rule" ;
    rdfs:comment "Individual policy rule" .

iam:Condition a owl:Class ;
    rdfs:label "Condition" ;
    rdfs:comment "Policy evaluation condition" .

# ============================================================================
# AUTHORIZATION CLASSES - ReBAC
# ============================================================================

iam:ReBAC a owl:Class ;
    rdfs:subClassOf iam:Authorization ;
    rdfs:label "Relationship-Based Access Control" ;
    rdfs:comment "ReBAC authorization model (Zanzibar)" .

iam:Relation a owl:Class ;
    rdfs:label "Relation" ;
    rdfs:comment "Relationship between entities" .

iam:Namespace a owl:Class ;
    rdfs:label "Namespace" ;
    rdfs:comment "ReBAC namespace for resources" .

iam:Tuple a owl:Class ;
    rdfs:label "Tuple" ;
    rdfs:comment "Relationship tuple (subject, relation, object)" .

# ============================================================================
# SSO & FEDERATION CLASSES
# ============================================================================

iam:SingleSignOn a owl:Class ;
    rdfs:label "Single Sign-On (SSO)" ;
    rdfs:comment "SSO configuration" .

iam:IdentityProvider a owl:Class ;
    rdfs:label "Identity Provider (IdP)" ;
    rdfs:comment "External identity provider" .

iam:ServiceProvider a owl:Class ;
    rdfs:label "Service Provider (SP)" ;
    rdfs:comment "Service consuming identities" .

iam:Federation a owl:Class ;
    rdfs:label "Federation" ;
    rdfs:comment "Identity federation configuration" .

iam:TrustRelationship a owl:Class ;
    rdfs:label "Trust Relationship" ;
    rdfs:comment "Trust between IdP and SP" .

# ============================================================================
# SESSION MANAGEMENT CLASSES
# ============================================================================

iam:Session a owl:Class ;
    rdfs:label "Session" ;
    rdfs:comment "User session" .

iam:SessionToken a owl:Class ;
    rdfs:label "Session Token" ;
    rdfs:comment "Session authentication token" .

iam:RefreshToken a owl:Class ;
    rdfs:label "Refresh Token" ;
    rdfs:comment "Token for refreshing access tokens" .

iam:AccessToken a owl:Class ;
    rdfs:label "Access Token" ;
    rdfs:comment "Access token (JWT, opaque)" .

iam:IdToken a owl:Class ;
    rdfs:label "ID Token" ;
    rdfs:comment "OpenID Connect ID token" .

# ============================================================================
# JWT & TOKEN CLASSES
# ============================================================================

iam:JWT a owl:Class ;
    rdfs:label "JSON Web Token (JWT)" ;
    rdfs:comment "JWT token structure" .

iam:JWTHeader a owl:Class ;
    rdfs:label "JWT Header" ;
    rdfs:comment "JWT header with algorithm" .

iam:JWTPayload a owl:Class ;
    rdfs:label "JWT Payload" ;
    rdfs:comment "JWT claims payload" .

iam:JWTSignature a owl:Class ;
    rdfs:label "JWT Signature" ;
    rdfs:comment "JWT cryptographic signature" .

iam:Claim a owl:Class ;
    rdfs:label "Claim" ;
    rdfs:comment "JWT claim (iss, sub, aud, exp)" .

# ============================================================================
# API KEY MANAGEMENT CLASSES
# ============================================================================

iam:ApiKey a owl:Class ;
    rdfs:label "API Key" ;
    rdfs:comment "API key for service authentication" .

iam:ApiKeyScope a owl:Class ;
    rdfs:label "API Key Scope" ;
    rdfs:comment "Scope limiting API key permissions" .

iam:RateLimitPolicy a owl:Class ;
    rdfs:label "Rate Limit Policy" ;
    rdfs:comment "API key rate limiting" .

# ============================================================================
# AUDIT & COMPLIANCE CLASSES
# ============================================================================

iam:AuditLog a owl:Class ;
    rdfs:label "Audit Log" ;
    rdfs:comment "Security audit log entry" .

iam:LoginEvent a owl:Class ;
    rdfs:subClassOf iam:AuditLog ;
    rdfs:label "Login Event" ;
    rdfs:comment "User login event" .

iam:LogoutEvent a owl:Class ;
    rdfs:subClassOf iam:AuditLog ;
    rdfs:label "Logout Event" ;
    rdfs:comment "User logout event" .

iam:PermissionChange a owl:Class ;
    rdfs:subClassOf iam:AuditLog ;
    rdfs:label "Permission Change" ;
    rdfs:comment "Permission modification event" .

iam:AccessDenied a owl:Class ;
    rdfs:subClassOf iam:AuditLog ;
    rdfs:label "Access Denied" ;
    rdfs:comment "Access denial event" .

iam:ComplianceReport a owl:Class ;
    rdfs:label "Compliance Report" ;
    rdfs:comment "Compliance audit report" .

# ============================================================================
# PROPERTIES - Identity
# ============================================================================

iam:username a owl:DatatypeProperty ;
    rdfs:domain iam:User ;
    rdfs:range xsd:string ;
    rdfs:label "username" ;
    rdfs:comment "User login name" .

iam:email a owl:DatatypeProperty ;
    rdfs:domain iam:User ;
    rdfs:range xsd:string ;
    rdfs:label "email" ;
    rdfs:comment "User email address" .

iam:displayName a owl:DatatypeProperty ;
    rdfs:domain iam:Identity ;
    rdfs:range xsd:string ;
    rdfs:label "display name" ;
    rdfs:comment "Human-readable display name" .

iam:enabled a owl:DatatypeProperty ;
    rdfs:domain iam:Identity ;
    rdfs:range xsd:boolean ;
    rdfs:label "enabled" ;
    rdfs:comment "Whether identity is enabled" .

# ============================================================================
# PROPERTIES - Authentication
# ============================================================================

iam:passwordHash a owl:DatatypeProperty ;
    rdfs:domain iam:PasswordAuthentication ;
    rdfs:range xsd:string ;
    rdfs:label "password hash" ;
    rdfs:comment "Hashed password (bcrypt, argon2)" .

iam:clientId a owl:DatatypeProperty ;
    rdfs:domain iam:OAuth2 ;
    rdfs:range xsd:string ;
    rdfs:label "client ID" ;
    rdfs:comment "OAuth2 client identifier" .

iam:clientSecret a owl:DatatypeProperty ;
    rdfs:domain iam:OAuth2 ;
    rdfs:range xsd:string ;
    rdfs:label "client secret" ;
    rdfs:comment "OAuth2 client secret" .

iam:redirectUri a owl:DatatypeProperty ;
    rdfs:domain iam:OAuth2 ;
    rdfs:range xsd:string ;
    rdfs:label "redirect URI" ;
    rdfs:comment "OAuth2 redirect URI" .

iam:scope a owl:DatatypeProperty ;
    rdfs:domain iam:OAuth2 ;
    rdfs:range xsd:string ;
    rdfs:label "scope" ;
    rdfs:comment "OAuth2 scope" .

# ============================================================================
# PROPERTIES - Session & Tokens
# ============================================================================

iam:sessionId a owl:DatatypeProperty ;
    rdfs:domain iam:Session ;
    rdfs:range xsd:string ;
    rdfs:label "session ID" ;
    rdfs:comment "Unique session identifier" .

iam:expiresAt a owl:DatatypeProperty ;
    rdfs:domain iam:Session ;
    rdfs:range xsd:dateTime ;
    rdfs:label "expires at" ;
    rdfs:comment "Session expiration timestamp" .

iam:createdAt a owl:DatatypeProperty ;
    rdfs:domain iam:Session ;
    rdfs:range xsd:dateTime ;
    rdfs:label "created at" ;
    rdfs:comment "Session creation timestamp" .

iam:lastAccessedAt a owl:DatatypeProperty ;
    rdfs:domain iam:Session ;
    rdfs:range xsd:dateTime ;
    rdfs:label "last accessed at" ;
    rdfs:comment "Last session access time" .

iam:tokenValue a owl:DatatypeProperty ;
    rdfs:domain iam:AccessToken ;
    rdfs:range xsd:string ;
    rdfs:label "token value" ;
    rdfs:comment "Token string value" .

iam:issuer a owl:DatatypeProperty ;
    rdfs:domain iam:JWT ;
    rdfs:range xsd:string ;
    rdfs:label "issuer (iss)" ;
    rdfs:comment "JWT issuer claim" .

iam:subject a owl:DatatypeProperty ;
    rdfs:domain iam:JWT ;
    rdfs:range xsd:string ;
    rdfs:label "subject (sub)" ;
    rdfs:comment "JWT subject claim" .

iam:audience a owl:DatatypeProperty ;
    rdfs:domain iam:JWT ;
    rdfs:range xsd:string ;
    rdfs:label "audience (aud)" ;
    rdfs:comment "JWT audience claim" .

iam:expiration a owl:DatatypeProperty ;
    rdfs:domain iam:JWT ;
    rdfs:range xsd:dateTime ;
    rdfs:label "expiration (exp)" ;
    rdfs:comment "JWT expiration time" .

# ============================================================================
# PROPERTIES - Authorization
# ============================================================================

iam:roleName a owl:DatatypeProperty ;
    rdfs:domain iam:Role ;
    rdfs:range xsd:string ;
    rdfs:label "role name" ;
    rdfs:comment "Name of the role" .

iam:permissionName a owl:DatatypeProperty ;
    rdfs:domain iam:Permission ;
    rdfs:range xsd:string ;
    rdfs:label "permission name" ;
    rdfs:comment "Name of the permission" .

iam:resource a owl:DatatypeProperty ;
    rdfs:domain iam:Permission ;
    rdfs:range xsd:string ;
    rdfs:label "resource" ;
    rdfs:comment "Resource type or ARN" .

iam:action a owl:DatatypeProperty ;
    rdfs:domain iam:Permission ;
    rdfs:range xsd:string ;
    rdfs:label "action" ;
    rdfs:comment "Permitted action (read, write, delete)" .

iam:effect a owl:DatatypeProperty ;
    rdfs:domain iam:PolicyRule ;
    rdfs:range xsd:string ;
    rdfs:label "effect" ;
    rdfs:comment "Policy effect (Allow, Deny)" .

# ============================================================================
# PROPERTIES - Audit
# ============================================================================

iam:eventType a owl:DatatypeProperty ;
    rdfs:domain iam:AuditLog ;
    rdfs:range xsd:string ;
    rdfs:label "event type" ;
    rdfs:comment "Type of audit event" .

iam:timestamp a owl:DatatypeProperty ;
    rdfs:domain iam:AuditLog ;
    rdfs:range xsd:dateTime ;
    rdfs:label "timestamp" ;
    rdfs:comment "Event timestamp" .

iam:ipAddress a owl:DatatypeProperty ;
    rdfs:domain iam:AuditLog ;
    rdfs:range xsd:string ;
    rdfs:label "IP address" ;
    rdfs:comment "Source IP address" .

iam:userAgent a owl:DatatypeProperty ;
    rdfs:domain iam:AuditLog ;
    rdfs:range xsd:string ;
    rdfs:label "user agent" ;
    rdfs:comment "HTTP user agent string" .

# ============================================================================
# OBJECT PROPERTIES - Relationships
# ============================================================================

iam:hasRole a owl:ObjectProperty ;
    rdfs:domain iam:User ;
    rdfs:range iam:Role ;
    rdfs:label "has role" ;
    rdfs:comment "User assigned to role" .

iam:hasPermission a owl:ObjectProperty ;
    rdfs:domain iam:Role ;
    rdfs:range iam:Permission ;
    rdfs:label "has permission" ;
    rdfs:comment "Role grants permission" .

iam:memberOf a owl:ObjectProperty ;
    rdfs:domain iam:User ;
    rdfs:range iam:Group ;
    rdfs:label "member of" ;
    rdfs:comment "User is member of group" .

iam:hasSession a owl:ObjectProperty ;
    rdfs:domain iam:User ;
    rdfs:range iam:Session ;
    rdfs:label "has session" ;
    rdfs:comment "User has active session" .

iam:hasAuthenticationMethod a owl:ObjectProperty ;
    rdfs:domain iam:User ;
    rdfs:range iam:Authentication ;
    rdfs:label "has authentication method" ;
    rdfs:comment "User uses authentication method" .

iam:hasMFA a owl:ObjectProperty ;
    rdfs:domain iam:User ;
    rdfs:range iam:MultiFactorAuthentication ;
    rdfs:label "has MFA" ;
    rdfs:comment "User has MFA enabled" .

iam:hasPolicy a owl:ObjectProperty ;
    rdfs:domain iam:Identity ;
    rdfs:range iam:Policy ;
    rdfs:label "has policy" ;
    rdfs:comment "Identity subject to policy" .

iam:hasApiKey a owl:ObjectProperty ;
    rdfs:domain iam:ServiceAccount ;
    rdfs:range iam:ApiKey ;
    rdfs:label "has API key" ;
    rdfs:comment "Service account uses API key" .
