using Microsoft.AspNetCore.Authorization;

namespace ZB.MOM.WW.MxGateway.Server.Dashboard;

/// <summary>
/// Requirement satisfied when the user has any one of the listed roles, or
/// when an environment-level bypass (auth disabled / loopback) is in effect.
/// </summary>
public sealed class DashboardAuthorizationRequirement(IReadOnlyList<string> requiredRoles) : IAuthorizationRequirement
{
    /// <summary>Gets the list of roles required to satisfy this requirement.</summary>
    public IReadOnlyList<string> RequiredRoles { get; } = requiredRoles;

    /// <summary>Gets a requirement satisfied by any dashboard role (admin or viewer).</summary>
    public static DashboardAuthorizationRequirement AnyDashboardRole { get; } =
        new([DashboardRoles.Admin, DashboardRoles.Viewer]);

    /// <summary>Gets a requirement satisfied only by the admin role.</summary>
    public static DashboardAuthorizationRequirement AdminOnly { get; } =
        new([DashboardRoles.Admin]);
}