# METADATA
# title: Data source policy for ds:per-diem-rates
# description: |
#   Only agent-per-diem-calculator may read per-diem rates, and only within
#   an active user session. Filters country+valid_on are required; city is
#   optional. No write operations through this policy; rate maintenance is a
#   separate admin flow.
# authors:
#   - CTO Agent <cto@basicstack.de>
# related_resources:
#   - ref: docs/architecture/v1.1.md#user-content-62-deterministische-regelwerke-am-beispiel-spesensätze-verpflegungsmehraufwand
#   - ref: schemas/ds/per_diem/v1.0.0.json
package proofedmesh.data_sources.per_diem_rates

import rego.v1

default allow := false

allow if {
	input.data_source == "ds:per-diem-rates"
	input.operation == "read"
	input.user_sub != ""
	input.session_id != ""
	input.agent_id == "agent-per-diem-calculator"
	input.resource == "rates"
	filters_ok
}

allowed_filters := {"country", "city", "valid_on"}
required_filters := {"country", "valid_on"}

filters_ok if {
	provided := {k | some k; _ := input.filters[k]}
	count(provided - allowed_filters) == 0
	count(required_filters - provided) == 0
}

deny_reason contains msg if {
	input.data_source != "ds:per-diem-rates"
	msg := sprintf("wrong data_source: %s", [input.data_source])
}

deny_reason contains msg if {
	input.operation != "read"
	msg := sprintf("operation %s not allowed on ds:per-diem-rates (reads only)", [input.operation])
}

deny_reason contains msg if {
	input.user_sub == ""
	msg := "missing user_sub (per-diem reads require active user session)"
}

deny_reason contains msg if {
	input.agent_id != "agent-per-diem-calculator"
	msg := sprintf("agent %s not allowed to read per-diem rates (only agent-per-diem-calculator)", [input.agent_id])
}

deny_reason contains msg if {
	not filters_ok
	msg := "filters must include country and valid_on; only country, city, valid_on allowed"
}