import "server-only"

import type { DataScope, Role } from "@/shared/types/permissions"

/**
 * A rule that maps one or more roles to a DataScope resolution strategy.
 *
 * The resolver iterates rules in array order (priority). For each rule,
 * if the user has any of the listed roles, `resolve` is called. A non-null
 * return value becomes the user's DataScope and iteration stops. A null
 * return value means "this role didn't yield a scope, try the next rule".
 *
 * This configuration-driven approach (P1-6 audit fix) replaces the
 * hardcoded `roleNames.includes("xxx")` chain in the old resolveDataScope.
 * Adding a new role or changing scope behaviour only requires editing this
 * config, not the resolver logic.
 */
export interface DataScopeRule {
  /** Roles that trigger this rule. */
  roles: Role[]
  /**
   * Resolve the DataScope for a user with one of `roles`.
   * Return null to fall through to the next rule.
   */
  resolve: (userId: string) => Promise<DataScope | null>
}
