// Package sandbox — permissions_module.go
//
// Read-only module for checking user permissions from Starlark scripts.
// No sandbox permission required — extensions can check whether a user
// has a specific permission without needing any special grants.
//
// Starlark API:
//   permissions.check(user_id, "image-gen.use")  → True/False
package sandbox

import (
	"context"

	"go.starlark.net/starlark"
	"go.starlark.net/starlarkstruct"

	"armature/auth"
	"armature/store"
)

// BuildPermissionsModule creates the "permissions" module.
// Always available to all extensions (no permission gate).
func BuildPermissionsModule(ctx context.Context, stores store.Stores) *starlarkstruct.Module {
	return MakeModule("permissions", starlark.StringDict{
		"check": starlark.NewBuiltin("permissions.check", func(
			thread *starlark.Thread, b *starlark.Builtin,
			args starlark.Tuple, kwargs []starlark.Tuple,
		) (starlark.Value, error) {
			var userID, perm string
			if err := starlark.UnpackPositionalArgs(b.Name(), args, kwargs, 2, &userID, &perm); err != nil {
				return nil, err
			}

			perms, err := auth.ResolvePermissions(ctx, stores, userID)
			if err != nil {
				return starlark.False, nil
			}
			if perms[perm] {
				return starlark.True, nil
			}
			return starlark.False, nil
		}),
	})
}