use remora_domain::OpaqueId;

use crate::error::CredentialError;
use crate::types::SourceCredential;

/// Caller identity for credential registry authorization.
#[derive(Clone, Debug, Eq, PartialEq)]
pub struct CredentialCaller {
    pub principal_id: OpaqueId,
    pub administrator: bool,
}

/// Owner or administrator may manage a credential; peers see NotFound.
#[must_use]
pub fn may_manage(caller: &CredentialCaller, owner: &OpaqueId) -> bool {
    caller.administrator || caller.principal_id == *owner
}

/// Map missing and unauthorized credentials to the same NotFound outcome.
pub fn require_manage(
    caller: &CredentialCaller,
    credential: Option<&SourceCredential>,
) -> Result<SourceCredential, CredentialError> {
    match credential {
        Some(record) if may_manage(caller, &record.owner) => Ok(record.clone()),
        Some(_) | None => Err(CredentialError::NotFound),
    }
}