from __future__ import annotations

from govoplan_core.auth import has_scope
from govoplan_core.core.modules import AccessDecision


class ProjectScopeAclProvider:
    """Expose coarse scope checks; the Projects registry rechecks object grants."""

    def __init__(self, resource_type: str) -> None:
        self.resource_type = resource_type

    def can_read(self, principal: object, resource_id: str) -> bool:
        del resource_id
        return has_scope(principal, "projects:project:read")

    def can_write(self, principal: object, resource_id: str) -> bool:
        del resource_id
        return has_scope(principal, "projects:project:write")

    def explain(self, principal: object, resource_id: str) -> AccessDecision:
        del resource_id
        allowed = self.can_read(principal, "")
        return AccessDecision(
            allowed=allowed,
            reason=None if allowed else "Missing scope: projects:project:read",
            requirements=("projects:project:read",),
        )


__all__ = ["ProjectScopeAclProvider"]