import type {
	Capability,
	PermissionAction,
	PermissionConfig,
	PermissionProfile,
	ZoneName,
} from "./config.ts";

export interface AccessRequest {
	tool: string;
	capability: Capability;
	resource: string;
	zone: ZoneName;
	kind: "file" | "bash";
	command?: string;
	justification?: string;
	agent?: string;
}

export interface PolicyDecision {
	action: PermissionAction;
	profile: string;
	reason: string;
}

function profileFor(config: PermissionConfig, zone: ZoneName): [string, PermissionProfile] {
	const profileName =
		zone === "workspace"
			? config.zones.workspace.profile
			: zone === "external"
				? config.zones.external.profile
				: config.zones.sensitive.profile;
	const profile = config.profiles[profileName];
	if (!profile) throw new Error(`Unknown permission profile: ${profileName}`);
	return [profileName, profile];
}

export function decide(config: PermissionConfig, request: AccessRequest): PolicyDecision {
	const [profileName, profile] = profileFor(config, request.zone);
	const action = profile[request.capability];
	return {
		action,
		profile: profileName,
		reason: `${request.zone} uses ${profileName}.${request.capability}=${action}`,
	};
}