package controller

import (
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/labels"

	terdutv1alpha1 "git.ryuvia.com/niklas/terdut-operator/api/v1alpha1"
)

// allowedTeamsPermits implements DESIGN.md §4.6's consent check in
// isolation from any client, so it's unit-testable against hand-built
// inputs the way classifyClusterGetError is. Same-namespace callers never
// call this at all (DESIGN.md §4.6: "same-namespace TerdutTeams are always
// allowed, regardless of this field") — it's only ever consulted for a
// cross-namespace serverRef.
func allowedTeamsPermits(allowed terdutv1alpha1.AllowedTeamsNamespaces, nsLabels map[string]string) (bool, error) {
	switch allowed.From {
	case "All":
		return true, nil
	case "Selector":
		if allowed.Selector == nil {
			return false, nil
		}
		sel, err := metav1.LabelSelectorAsSelector(allowed.Selector)
		if err != nil {
			return false, err
		}
		return sel.Matches(labels.Set(nsLabels)), nil
	default:
		// "", "None", "Same" -- Same is equivalent to None in effect for a
		// cross-namespace caller (DESIGN.md §4.6: same-namespace is
		// unrestricted either way, Same only exists for parity with the
		// upstream enum this mirrors).
		return false, nil
	}
}