"""Assertion helpers for authorization testing.

These are predicate functions passed to AuthScenario.assert_that() to check
whether a decision should be allowed or denied.
"""

from __future__ import annotations

from pyauthz.core.decision import Decision


def must_allow(decision: Decision) -> tuple[bool, str]:
    """Assert that the decision allows access.

    Returns:
        (passed, message) tuple.
    """
    if decision.allowed:
        return True, "access correctly allowed"
    reasons = "; ".join(decision.reasoning) or "no reason given"
    return False, f"expected ALLOW but got DENY: {reasons}"


def must_deny(decision: Decision) -> tuple[bool, str]:
    """Assert that the decision denies access.

    Returns:
        (passed, message) tuple.
    """
    if not decision.allowed:
        return True, "access correctly denied"
    reasons = "; ".join(decision.reasoning) or "no reason given"
    return False, f"expected DENY but got ALLOW: {reasons}"
