package auth

import (
	"github.com/kami/maven/internal/ipc"
)

// Scope — the resolved authority of a caller. Built by Enrollment *once*
// when a connection is accepted (or once per call, depending on impl), then
// threaded through Check → Can as pure data. The impure part (looking up the
// module enrollment table from ipc.Caller Uid+Pid) ends at the Enrollment
// boundary; everything downstream is pure.
type Scope struct {
	// Surface — the channel the caller entered through. Caps the layer.
	Surface Surface

	// Module — the enrolled module name ("tts", "poll:healthcheck",
	// "router", "telegram-relay", ""). "" ⇒ unenrolled; Check refuses.
	// The daemon's in-process path sets "core" by convention.
	Module string

	// SourceScope — the sources this module may WriteFact under. The spec's
	// exact "compromised poller can't forge a trigger" guard: a module
	// only writes sources it owns. The floor enrollment grants "*"
	// (anything); a real enrollment scopes a poller to one source prefix.
	// Empty slice ⇒ refuse all writes (fail closed); the daemon never sets
	// this empty for an enrolled caller.
	SourceScope []string
}

// Lookup — the Enroller's input: ipc.Caller when present (Uid/Pid from
// SO_PEERCRED on the socket), or the zero value for in-process (no Caller
// attached to ctx — the daemon treats this as SurfaceCoreProcess, "core").
type Lookup struct {
	// Caller — when CallerFrom(ctx) is absent (the in-process path), this is
	// the zero ipc.Caller. The Enrollment floor returns SurfaceCoreProcess in
	// that case.
	Caller    ipc.Caller
	HasCaller bool
}