// Package policy decides whether a given subject (= agent / client identity
// from the Pocket ID token) may sign a given key_ref. The in-prod backend is
// OPA; the dev-mode backend is AllowAll. OPA wiring is a follow-up subtask.
package policy

import (
	"context"
	"errors"
)

// Decision carries both the boolean verdict and (on deny) a human-readable
// reason that the HTTP layer surfaces in the error response.
type Decision struct {
	Allow  bool
	Reason string
}

// Decider abstracts the policy backend.
type Decider interface {
	Allow(ctx context.Context, subject, keyRef string) (Decision, error)
}

// AllowAll permits everything. Dev / CI only. Logs loudly in main.
type AllowAll struct{}

func (AllowAll) Allow(_ context.Context, _, _ string) (Decision, error) {
	return Decision{Allow: true}, nil
}

// OPA is a stub for the real Rego-backed policy evaluator.
type OPA struct{}

var errNotWired = errors.New("policy.OPA: not wired yet (follow-up subtask)")

func (OPA) Allow(_ context.Context, _, _ string) (Decision, error) {
	return Decision{}, errNotWired
}