from __future__ import annotations

from govoplan_core.auth import has_scope
from govoplan_core.core.modules import AccessDecision


class CaseAclProvider:
    """Expose the tenant-level Case permission boundary to generic consumers."""

    resource_type = "case"

    def can_read(self, principal: object, resource_id: str) -> bool:
        del resource_id
        return has_scope(principal, "cases:case:read")

    def can_write(self, principal: object, resource_id: str) -> bool:
        del resource_id
        return has_scope(principal, "cases:case:update")

    def explain(self, principal: object, resource_id: str) -> AccessDecision:
        del resource_id
        allowed = self.can_read(principal, "")
        return AccessDecision(
            allowed=allowed,
            reason=None if allowed else "Missing scope: cases:case:read",
            requirements=("cases:case:read",),
        )


__all__ = ["CaseAclProvider"]