from __future__ import annotations

from dataclasses import dataclass
from typing import Literal

from govoplan_access.backend.permissions.evaluator import scopes_grant


AuthMethod = Literal["session", "api_key", "service_account"]


@dataclass(frozen=True, slots=True)
class Principal:
    account_id: str
    membership_id: str | None
    tenant_id: str | None
    scopes: frozenset[str]
    group_ids: frozenset[str]
    auth_method: AuthMethod
    api_key_id: str | None = None
    session_id: str | None = None
    service_account_id: str | None = None
    email: str | None = None
    display_name: str | None = None

    def has(self, required: str) -> bool:
        return scopes_grant(self.scopes, required)