feat: wildcard excludeの実装

src/main/kotlin/net/hareworks/permits_lib/domain/MutablePermissionTree.kt

@@ -103,6 +103,18 @@ class MutablePermissionTree internal constructor(
             val newPermissionId = PermissionId.of("${this.id.value}.${newId.lowercase()}")
             renameSubtree(oldPermissionId, newPermissionId)
         }
+
+        fun excludeWildcardChild(id: String) {
+            require(id.isNotBlank()) { "Wildcard exclusion id must not be blank." }
+            val permissionId = PermissionId.of("${this.id.value}.${id.lowercase()}")
+            draft.wildcardExclusions.add(permissionId)
+        }
+
+        fun excludeWildcardChildAbsolute(id: String) {
+            require(id.isNotBlank()) { "Wildcard exclusion id must not be blank." }
+            val permissionId = PermissionId.of(id.lowercase())
+            draft.wildcardExclusions.add(permissionId)
+        }
     }
 
     private fun removeSubtree(rootId: PermissionId) {
@@ -150,7 +162,8 @@ class MutablePermissionTree internal constructor(
                 defaultValue = draft.defaultValue,
                 children = draft.children.toMutableMap(),
                 wildcard = draft.wildcard,
-                registration = draft.registration
+                registration = draft.registration,
+                wildcardExclusions = draft.wildcardExclusions.toMutableSet()
             )
             drafts[newId] = newDraft
         }

src/main/kotlin/net/hareworks/permits_lib/domain/PermissionNode.kt

@@ -14,7 +14,8 @@ data class PermissionNode(
     val defaultValue: PermissionDefault = PermissionDefault.FALSE,
     val children: Map<PermissionId, Boolean> = emptyMap(),
     val wildcard: Boolean = false,
-    val registration: NodeRegistration = NodeRegistration.PERMISSION
+    val registration: NodeRegistration = NodeRegistration.PERMISSION,
+    val wildcardExclusions: Set<PermissionId> = emptySet()
 ) {
     init {
         require(children.keys.none { it == id }) { "Permission node cannot be a child of itself." }

src/main/kotlin/net/hareworks/permits_lib/domain/PermissionNodeDraft.kt

@@ -8,7 +8,8 @@ internal data class PermissionNodeDraft(
     var defaultValue: PermissionDefault = PermissionDefault.FALSE,
     val children: MutableMap<PermissionId, Boolean> = linkedMapOf(),
     var wildcard: Boolean = false,
-    var registration: NodeRegistration = NodeRegistration.PERMISSION
+    var registration: NodeRegistration = NodeRegistration.PERMISSION,
+    val wildcardExclusions: MutableSet<PermissionId> = linkedSetOf()
 ) {
     fun toNode(): PermissionNode =
         PermissionNode(
@@ -17,7 +18,8 @@ internal data class PermissionNodeDraft(
             defaultValue = defaultValue,
             children = children.toMap(),
             wildcard = wildcard,
-            registration = registration
+            registration = registration,
+            wildcardExclusions = wildcardExclusions.toSet()
         )
 
     companion object {
@@ -28,7 +30,8 @@ internal data class PermissionNodeDraft(
                 defaultValue = node.defaultValue,
                 children = node.children.toMutableMap(),
                 wildcard = node.wildcard,
-                registration = node.registration
+                registration = node.registration,
+                wildcardExclusions = node.wildcardExclusions.toMutableSet()
             )
     }
 }

src/main/kotlin/net/hareworks/permits_lib/domain/WildcardAugmentor.kt

@@ -12,7 +12,9 @@ internal object WildcardAugmentor {
             if (node.id.value.endsWith(".*")) return@forEach
 
             val wildcardId = PermissionId.of("${node.id.value}.*")
-            val updatedChildren = node.children.toMutableMap()
+            val updatedChildren = node.children
+                .filterKeys { childId -> childId !in node.wildcardExclusions }
+                .toMutableMap()
 
             val existing = result[wildcardId]
             if (existing == null) {

src/main/kotlin/net/hareworks/permits_lib/dsl/PermissionNodeBuilder.kt

@@ -28,6 +28,11 @@ class PermissionNodeBuilder internal constructor(
             draft.wildcard = value
         }
 
+    fun wildcard(block: WildcardDsl.() -> Unit) {
+        wildcard = true
+        WildcardDsl(draft).apply(block)
+    }
+
     var registration: NodeRegistration
         get() = draft.registration
         set(value) {
@@ -66,3 +71,18 @@ class PermissionNodeBuilder internal constructor(
         treeBuilder.nestedNode(draft, id, registration, block)
     }
 }
+
+class WildcardDsl internal constructor(
+    private val draft: PermissionNodeDraft
+) {
+    fun exclude(vararg segments: String) {
+        val normalized = segments
+            .flatMap { it.split('.') }
+            .map { it.trim().lowercase() }
+            .filter { it.isNotEmpty() }
+        if (normalized.isEmpty()) return
+        val suffix = normalized.joinToString(".")
+        val permissionId = PermissionId.of("${draft.id.value}.$suffix")
+        draft.wildcardExclusions.add(permissionId)
+    }
+}