_ = require 'underscore'

class Checkpoint

  # resource.modelName is a stupid workaround to Mongoose 
  # weird nonstandard way of doing things. `name` is "model"
  # on all Mongoose "classes". WTF?
  # `p` is for permissions

  @check: (p, user, resource, action) ->
    res = resource.modelName or resource.name or resource
    _.any _.map(user.roles, (role) ->
      return false unless p[role] and p[role][res]
      return _.contains p[role][res], action
    )

  @allow: (User, permissions) ->
    User.prototype.can = (act, resource) ->
      Checkpoint.check permissions, @, resource, act

Checkpoint.allow.Checkpoint = Checkpoint
module.exports = Checkpoint.allow