import type { PrincipalContext } from './principal';

export interface PolicyDecisionOk {
  ok: true;
}
export interface PolicyDecisionDeny {
  ok: false;
  code: string;
  message: string;
  details?: unknown;
}
export type PolicyDecision = PolicyDecisionOk | PolicyDecisionDeny;

export interface PolicyInput {
  principal: PrincipalContext;
  fromRoot: string;
  toRoot: string;
  toPath: string;
  msgType: string;
  /** @deprecated Use fromRoot */
  fromRealm?: string;
  /** @deprecated Use toRoot */
  toRealm?: string;
}

export interface Policy {
  authorize(input: PolicyInput): PolicyDecision;
}

export class AllowAllPolicy implements Policy {
  authorize(_input: PolicyInput): PolicyDecision {
    return { ok: true };
  }
}

/** Simple deny-list policy for tests */
export class DenyPathPrefixPolicy implements Policy {
  constructor(private readonly denyPrefix: string) {}
  authorize(input: PolicyInput): PolicyDecision {
    if (input.toPath.startsWith(this.denyPrefix)) {
      return { ok: false, code: 'MXSEC.DENY', message: `Denied by policy: ${this.denyPrefix}` };
    }
    return { ok: true };
  }
}
