// `storage.uploadDocument` — stores a PRIVATE document. The owner is
// always allowed; this policy additionally grants the `admin` role and
// same-tenant subjects. Fetch the bytes via the plugin's access-checked
// `storage.mintUrl` route, or grant a specific user/group from the
// dashboard's Storage tab.

import { Schema } from 'effect'
import { defineAction } from '@voltro/protocol'

export const uploadDocument = defineAction({
  name: 'storage.uploadDocument',
  // The WRITE is open; the READ is not, and the split is the point. This stores
  // caller-supplied bytes as a PRIVATE object and returns only its id — the
  // bytes come back exclusively through the plugin's access-checked
  // `storage.mintUrl` route, which applies the object's policy (owner + tenant
  // + granted roles) and is not this procedure's decision to make.
  //
  // No auth strategy ships in this template, so a `guards:` here would deny
  // every caller. Add one, then `guards: [{ scope: 'files:write' }]`.
  openAccess:
    'stores caller-supplied bytes as a new PRIVATE object and returns only its id; reading it '
    + 'back goes through the plugin\'s access-checked `storage.mintUrl`, which this does not '
    + 'bypass. Guard the write too once the app has an identity.',
  input: Schema.Struct({
    bytesBase64: Schema.String,
    contentType: Schema.String,
    filename: Schema.String,
  }),
  output: Schema.Struct({
    id: Schema.String,
  }),
})