using Microsoft.AspNetCore.Authorization;

namespace ZB.MOM.WW.MxGateway.Server.Dashboard;

/// <summary>
/// Requirement satisfied ONLY by an authenticated principal holding one of
/// <see cref="RequiredRoles"/> as a real role claim. Unlike
/// <see cref="DashboardAuthorizationRequirement"/> there is no environment bypass: it is a
/// distinct requirement type, so <see cref="DashboardAuthorizationHandler"/> —
/// an <c>AuthorizationHandler&lt;DashboardAuthorizationRequirement&gt;</c> — is never invoked for
/// it and its <c>Authentication:Mode=Disabled</c> / anonymous-localhost arms cannot reach it.
/// The type distinction is the enforcement; adding a bypass arm to the other handler cannot leak
/// into this one by accident.
/// </summary>
/// <remarks>
/// Introduced to gate the alarm feed (<c>AlarmsHub</c> and the <c>/alarms</c> page),
/// which is gateway-central and session-less and therefore carries no per-session provenance the
/// tag ACL could scope it by. Requiring a real dashboard role claim is the narrowing that
/// is actually available: it keeps galaxy-wide alarm metadata — alarm reference (a full tag path),
/// state, severity, category, area, acknowledging operator — away from the read-only environment
/// bypasses, which exist for local development and unauthenticated deployments rather than as a
/// grant of plant-wide visibility. The same pattern the shared Secrets UI relies on: a policy the
/// dashboard bypass handler cannot satisfy because the requirement type differs.
/// </remarks>
/// <param name="requiredRoles">Roles any one of which satisfies the requirement.</param>
public sealed class AuthenticatedDashboardRoleRequirement(IReadOnlyList<string> requiredRoles)
    : IAuthorizationRequirement
{
    /// <summary>Gets the roles, any one of which satisfies this requirement.</summary>
    public IReadOnlyList<string> RequiredRoles { get; } = requiredRoles;

    /// <summary>
    /// Gets the requirement satisfied by an authenticated caller holding either dashboard role.
    /// Same role set as <see cref="DashboardAuthorizationRequirement.AnyDashboardRole"/>; the
    /// difference is entirely that no environment bypass applies.
    /// </summary>
    public static AuthenticatedDashboardRoleRequirement AnyDashboardRole { get; } =
        new([DashboardRoles.Admin, DashboardRoles.Viewer]);
}