Implement list allowed and explain

internal/registry/store.go

@@ -246,6 +246,36 @@ func (s *Store) Resource(system, id string) (api.Resource, bool) {
 	return resource, ok
 }
 
+// ResourceRefs returns deterministic resource references filtered by system and
+// resource type. Empty filters match all values.
+func (s *Store) ResourceRefs(system, resourceType string) []api.ResourceRef {
+	keys := make([]string, 0, len(s.resources))
+	for key, resource := range s.resources {
+		resourceSystem, _ := splitResourceKey(key)
+		if system != "" && resourceSystem != system {
+			continue
+		}
+		if resourceType != "" && resource.Type != resourceType {
+			continue
+		}
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+
+	refs := make([]api.ResourceRef, 0, len(keys))
+	for _, key := range keys {
+		resourceSystem, _ := splitResourceKey(key)
+		resource := s.resources[key]
+		refs = append(refs, api.ResourceRef{
+			ID:         resource.ID,
+			Type:       resource.Type,
+			System:     resourceSystem,
+			Attributes: resourceRefAttributes(resource),
+		})
+	}
+	return refs
+}
+
 // Subject looks up a subject by id.
 func (s *Store) Subject(id string) (api.Subject, bool) {
 	subject, ok := s.subjects[id]
@@ -299,6 +329,38 @@ func resourceKey(system, id string) string {
 	return system + "\x00" + id
 }
 
+func splitResourceKey(key string) (string, string) {
+	for i := range key {
+		if key[i] == '\x00' {
+			return key[:i], key[i+1:]
+		}
+	}
+	return "", key
+}
+
+func resourceRefAttributes(resource api.Resource) map[string]any {
+	attrs := make(map[string]any, len(resource.Attributes)+5)
+	for key, value := range resource.Attributes {
+		attrs[key] = value
+	}
+	if resource.Path != "" {
+		attrs["path"] = resource.Path
+	}
+	if resource.Parent != "" {
+		attrs["parent"] = resource.Parent
+	}
+	if len(resource.Labels) > 0 {
+		attrs["labels"] = resource.Labels
+	}
+	if resource.TrustZone != "" {
+		attrs["trust_zone"] = resource.TrustZone
+	}
+	if resource.Owner != "" {
+		attrs["owner"] = resource.Owner
+	}
+	return attrs
+}
+
 func sortedValues[T any](items map[string]T) []T {
 	keys := make([]string, 0, len(items))
 	for key := range items {