<?php
// SPDX-License-Identifier: GPL-3.0-or-later
declare(strict_types=1);

namespace Aiwend\Policy;

/**
 * Policy outcome. Error policy (see docs/api.md):
 * - unauthenticated (401): operation needs a logged-in user and there is none.
 * - forbidden (403): authenticated but lacking the capability for a site-level operation.
 * - not_found (404): object-scoped denial, so callers cannot probe for existence.
 */
final class Decision
{
    private function __construct(public readonly bool $allowed, public readonly string $code)
    {
    }

    public static function allow(): self
    {
        return new self(true, 'ok');
    }

    public static function unauthenticated(): self
    {
        return new self(false, 'unauthenticated');
    }

    public static function forbidden(): self
    {
        return new self(false, 'forbidden');
    }

    public static function notFound(): self
    {
        return new self(false, 'not_found');
    }

    public function httpStatus(): int
    {
        return match ($this->code) {
            'ok' => 200,
            'unauthenticated' => 401,
            'forbidden' => 403,
            default => 404,
        };
    }
}