package domain

import (
	"errors"

	"git.cin.su/m/Assistant/contracts/authority"
	"git.cin.su/m/Assistant/contracts/identity"
)

var ErrInvalidCreatorGrant = errors.New("creator grant must be active, global, and revisioned")

// ValidateCreatorGrant validates the narrow bootstrap authority used by
// Domovoy. Execution paths must still perform their own target/revision checks.
func ValidateCreatorGrant(binding identity.PrincipalBinding, scope authority.Scope, grant authority.AuthorityGrant) error {
	if binding.ActorID == "" || binding.PrincipalID == "" || !binding.Active ||
		!scope.Global || scope.ID == "" ||
		grant.ID == "" || grant.Class != authority.GrantClassCreator || !grant.Active || grant.Revision == 0 ||
		grant.ActorID != binding.ActorID || grant.PrincipalID != binding.PrincipalID || grant.ScopeID != scope.ID {
		return ErrInvalidCreatorGrant
	}
	return nil
}