authz

type AccessDescriptor interface {
	Principal() string
	Tenant() string
	Resource() string
	Permission() string
	Name() string

	WithPrincipal(string) AccessDescriptor
	WithTenant(string) AccessDescriptor
	WithResource(string) AccessDescriptor
	WithPermission(string) AccessDescriptor
	WithName(string) AccessDescriptor
}

type AccessFactory func() AccessDescriptor

type ArgFn func(int) string

type Authorizer interface {
	// Check determines if a given access request is permitted for a single resource.
	Check(ctx context.Context, tx *sql.Tx, fn ArgFn, accessDescriptor AccessDescriptor) bool
	// Partial generates a SQL expression (a WHERE clause) that can be used to
	// filter a list of resources based on the user's permissions.
	Partial(ctx context.Context, accessDescriptor AccessDescriptor, extraColumnMappings map[string]SQLColumnRef) (Expr, error)
}

type Expr interface {
	SQL(ArgFn, []any) (string, []any)
	Tables() []SQLTableRef
}

type SQLColumnRef struct {
	Table  string
	Column string
}

type SQLTableRef struct {
	Table string
}