"""flex-auth PEP port — fail-closed for sensitive actions when PDP missing."""

from __future__ import annotations

from dataclasses import dataclass

from django.conf import settings


@dataclass(frozen=True)
class AuthzDecision:
    allow: bool
    reason: str
    decision_id: str = ""


def check(action: str, *, resource: str = "shell", subject: str = "") -> AuthzDecision:
    """Decide whether `action` is allowed.

    - shell:view is allowed for any authenticated principal (shell smoke).
    - other actions require FLEX_AUTH_BASE_URL; until wired, deny.
    """
    if action == "shell:view":
        return AuthzDecision(allow=True, reason="shell-view-authenticated")

    if not settings.FLEX_AUTH_BASE_URL:
        return AuthzDecision(
            allow=False,
            reason="flex-auth-not-configured-fail-closed",
        )

    # TODO(CSOC-WP-0002-T07): HTTP call to flex-auth PDP
    return AuthzDecision(allow=False, reason="flex-auth-http-not-implemented")