auth Principal {
  id String
  role String?
}

mixin AuditFields {
  createdAt DateTime @default(dbgenerated())
  updatedAt DateTime @default(dbgenerated())
}

model Post {
  @use(AuditFields)

  id String @id
  title String

  @@allow("read", auth() != null)
}

// Server crate
use cratestack::include_server_schema;

include_server_schema!("schema.cstack", db = Postgres);

let pool = sqlx::PgPool::connect(&std::env::var("DATABASE_URL")?).await?;
let cool = cratestack_schema::Cratestack::builder(pool).build();

let visible_posts = cool
    .post()
    .find_many()
    .where_expr(
        cratestack_schema::post::author()
            .email()
            .eq("owner@example.com")
            .and(cratestack_schema::post::published().is_true()),
    )
    .order_by(cratestack_schema::post::author().email().desc())
    .limit(20)
    .run(&ctx)
    .await?;

let bound = cool.bind_auth(Some(serde_json::json!({
    "id": 7,
    "role": "admin"
})))?;

let posts = bound.post().find_many().run().await?;

let app = axum::Router::new().nest(
    "/api",
    cratestack_schema::axum::model_router(
        cool.clone(),
        (),
        cratestack_codec_cbor::CborCodec,
        AppAuthProvider,
    ),
);