// The pure ownership decision at the centre of the storage broker. No I/O:
// given who is calling and who owns a resource, decide allow or deny. The
// caller identity is always the trusted header value the service resolved,
// never an agent-supplied argument.

export type StorageAction = "list" | "read" | "write";

export interface AccessDecision {
  allow: boolean;
  reason: string;
}

export function authorizeAccess(params: {
  caller: string;
  owner: string | null;
  action: StorageAction;
}): AccessDecision {
  if (!params.caller) return { allow: false, reason: "no-caller" };
  if (params.owner === null) return { allow: false, reason: "unregistered" };
  if (params.owner !== params.caller) return { allow: false, reason: "cross-account" };
  return { allow: true, reason: "owner" };
}