import { defineAuthz } from "@wrnexus/authz";

/**
 * `app/authz/<name>.ts` declarations are discovered automatically and merged
 * into the process-wide catalog at boot (see `app/middleware/authz.ts`, which
 * registers the middleware that resolves against it).
 */
export default defineAuthz({
  permissions: {
    "post:read": { title: "View posts", public: true },
    "post:write": { title: "Create and edit posts" },
    "post:delete": { title: "Delete posts", risk: "high" },
    "admin:access": { title: "Reach the admin area", risk: "high" },
  },
  roles: {
    viewer: ["post:read"],
    editor: ["role:viewer", "post:write"],
    admin: ["role:editor", "post:delete", "admin:access"],
  },
  policies: {
    ownsPost: async (
      subject: { id?: string },
      resource?: { authorId?: string },
    ): Promise<{ allowed: boolean; reason?: string }> =>
      resource?.authorId === subject?.id
        ? { allowed: true }
        : { allowed: false, reason: "You are not the author" },
  },
  bindings: { "post:delete": ["ownsPost"] },
});