import { authzMiddleware, getAuthzCatalog, memoryPermissionStore } from "@wrnexus/authz";

/**
 * Registers the per-request authorization resolver against the catalog merged
 * from `app/authz/*.ts` (see `showcase.ts`). This is an eager, module-scope
 * call — the same shape `authzMiddleware({...})` requires — so it must run
 * after `getAuthzCatalog()` has been populated. Both the dev server and
 * `wrnexus build`'s generated production entry guarantee that happens before
 * any app middleware module evaluates.
 *
 * Middleware runs in alphabetical filename order, so `authz.ts` runs after
 * `auth.ts`, which hydrates `ctx.user` from the session. Route handlers and
 * pages can then call `can(ctx, "post:write")` or guard a route with
 * `guardPermission("post:delete")`.
 *
 * A real deployment would swap `memoryPermissionStore()` for
 * `dbPermissionStore(getDb())` from `@wrnexus/authz/db` so role and grant
 * assignments survive a restart; the showcase keeps everything in memory so
 * it stays dependency-free.
 */
export default authzMiddleware({
  catalog: getAuthzCatalog(),
  store: memoryPermissionStore(),
});