"""The permission engine (02-domain-model §4; 04-architecture "the
authz engine is the load-bearing wall").

One choke point:
  - resolve_actor(request, session) -> Actor   (context.py)
  - can(actor, action, resource) -> Decision   (policy.py)
  - scope(actor, action, stmt) -> Select        (scope.py)
  - capability truth tables as data             (capabilities.py)
  - view-as enter/exit (app-layer context swap) (view_as.py)
"""

from app.services.authz.capabilities import (
    CAPABILITIES,
    capability_allowed,
    edit_entry_capability,
)
from app.services.authz.context import (
    TENANT_COOKIE,
    Actor,
    TenantRef,
    allowed_tenants,
    resolve_actor,
    resolve_actor_dep,
)
from app.services.authz.policy import Decision, can
from app.services.authz.scope import scope
from app.services.authz.view_as import (
    VIEW_AS_COOKIE,
    enter_view_as,
    exit_view_as,
)

__all__ = [
    "CAPABILITIES",
    "TENANT_COOKIE",
    "VIEW_AS_COOKIE",
    "Actor",
    "Decision",
    "TenantRef",
    "allowed_tenants",
    "can",
    "capability_allowed",
    "edit_entry_capability",
    "enter_view_as",
    "exit_view_as",
    "resolve_actor",
    "resolve_actor_dep",
    "scope",
]