// No authz in here — deliberately. The descriptor's `guards: [{ scope:
// 'notes:write' }]` already refused an unscoped caller before this executor
// was reached. Re-checking the same scope by hand would be a second copy of
// the rule that can drift from the first, and the one `voltro check` reads is
// the descriptor's.

import { EffectStore } from '@voltro/runtime'
import type { AppContext } from '@voltro/runtime'
import { Effect } from 'effect'

const execute = (input: { title: string; body: string }, _ctx: AppContext) =>
  Effect.gen(function* () {
    const store = yield* EffectStore
    // tenant() auto-fills tenantId from the subject — no need to pass it.
    const row = yield* store.insert('notes', { title: input.title, body: input.body })
    return {
      id: row['id'] as string,
      title: row['title'] as string,
      body: row['body'] as string,
      tenantId: row['tenantId'] as string,
    }
  })

export default execute