package lib

import (
	"context"

	"atlas9.dev/c/core"
	"atlas9.dev/c/core/iam"
)

// Guard checks whether a caller has permission for a cap.
type Guard interface {
	// Check verifies the caller has the cap within the given tenant and path.
	Check(ctx context.Context, cap iam.Cap, tenant core.ID, path core.Path) error
	// Partial verifies the caller has the cap at any tenant/path.
	Partial(ctx context.Context, cap iam.Cap) error
	// System verifies the caller has system-wide access for the cap (at system tenant root).
	System(ctx context.Context, cap iam.Cap) error
}