"""Condition model for ABAC attribute-based policy evaluation.

Conditions are defined in Phase 1 for schema completeness and YAML validation.
Condition *evaluation* is implemented in Phase 2.
"""

from typing import Any, Literal

from pydantic import BaseModel


class Condition(BaseModel):
    """An ABAC condition for attribute-based policy evaluation.

    Fields use dot-notation to reference attributes on the request context:
    - 'subject.id', 'subject.roles', 'subject.attributes.department'
    - 'resource.id', 'resource.type', 'resource.owner_id', 'resource.attributes.classification'
    - 'environment.hour', 'environment.ip', 'environment.tenant_id'

    When `value` is a string starting with 'subject.', 'resource.', or 'environment.',
    it is resolved as a cross-reference (e.g., resource.owner_id == subject.id).
    Otherwise, it is treated as a literal value.

    Supported operators: ==, !=, >, <, >=, <=, in, not_in, contains, matches (regex)

    Missing attributes during evaluation produce a DENY (fail-safe), not an error.

    Example:
        # Owner check — cross-reference
        Condition(field="resource.owner_id", op="==", value="subject.id")

        # Literal comparison
        Condition(field="resource.attributes.classification", op="==", value="TOP_SECRET")
    """

    field: str
    op: Literal["==", "!=", ">", "<", ">=", "<=", "in", "not_in", "contains", "matches"]
    value: Any
