package store

// Ownership helpers for portal JWT resource scoping.

// SeesAllOwned is true for API keys and portal admins (no per-user filter).
func SeesAllOwned(kind string, isAdmin bool) bool {
	if kind != "jwt" {
		return true
	}
	return isAdmin
}

// CanAccessOwned reports whether the actor may see/edit a resource with createdBy.
// Empty createdBy (legacy/API-key-created) is visible only when SeesAllOwned.
func CanAccessOwned(kind string, isAdmin bool, userID, createdBy string) bool {
	if SeesAllOwned(kind, isAdmin) {
		return true
	}
	if createdBy == "" {
		return false
	}
	return createdBy == userID
}

// FilterOwnedStrings keeps items whose owner matches the actor.
func FilterOwned[T any](items []T, owner func(T) string, kind string, isAdmin bool, userID string) []T {
	if SeesAllOwned(kind, isAdmin) {
		return items
	}
	out := make([]T, 0, len(items))
	for _, it := range items {
		if CanAccessOwned(kind, isAdmin, userID, owner(it)) {
			out = append(out, it)
		}
	}
	return out
}