"""Policy model — an access control rule that produces ALLOW or DENY."""

from pydantic import BaseModel

from pyauthz.models.action import Effect
from pyauthz.models.condition import Condition


class Policy(BaseModel):
    """An access control rule that produces ALLOW or DENY for matching requests.

    Policies are the core decision unit. A policy matches when:
    1. The subject has at least one role in the policy's `roles` list
       (empty roles = applies to all subjects)
    2. The requested action matches at least one of the policy's `permissions`
    3. All `conditions` (if any) evaluate to True

    Example:
        admin_access = Policy(
            name="admin-full-access",
            description="Admins can do anything",
            effect=Effect.ALLOW,
            roles=["admin"],
            permissions=["*:*"],
        )

        owner_edit = Policy(
            name="owner-edit-documents",
            description="Users can only edit their own documents",
            effect=Effect.ALLOW,
            roles=["editor"],
            permissions=["documents:write", "documents:delete"],
            conditions=[
                Condition(field="resource.owner_id", op="==", value="subject.id"),
            ],
        )
    """

    name: str
    description: str = ""
    effect: Effect
    roles: list[str] = []
    permissions: list[str] = []
    conditions: list[Condition] = []
    priority: int = 0
    enabled: bool = True
