"""Policy decision ports for application services."""

from __future__ import annotations

from typing import Any, Protocol

from kontextual_engine.core import OperationContext, PolicyDecision


class PolicyGateway(Protocol):
    def authorize(
        self,
        context: OperationContext,
        action: str,
        resource: str,
        *,
        resource_metadata: dict[str, Any] | None = None,
    ) -> PolicyDecision: ...


class AllowAllPolicyGateway:
    """Deterministic default for local development and tests."""

    def authorize(
        self,
        context: OperationContext,
        action: str,
        resource: str,
        *,
        resource_metadata: dict[str, Any] | None = None,
    ) -> PolicyDecision:
        return PolicyDecision.allow(
            context.actor.id,
            action,
            resource,
            context={"gateway": "allow-all", "resource_metadata": resource_metadata or {}},
        )