namespace ZB.MOM.WW.OtOpcUa.Admin.Security;

/// <summary>
///     Deterministic LDAP-group-to-Admin-role mapper driven by <see cref="LdapOptions.GroupToRole"/>.
///     Every returned role corresponds to a group the user actually holds; no inference.
/// </summary>
public static class RoleMapper
{
    public static IReadOnlyList<string> Map(
        IReadOnlyCollection<string> ldapGroups,
        IReadOnlyDictionary<string, string> groupToRole)
    {
        if (groupToRole.Count == 0) return [];

        var roles = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
        foreach (var group in ldapGroups)
        {
            if (groupToRole.TryGetValue(group, out var role))
                roles.Add(role);
        }
        return [.. roles];
    }
}