<?php

namespace NoahVet\Reef\Domain\Security\Port;

use NoahVet\Reef\Domain\Security\Model\Resource;
use NoahVet\Reef\Domain\Security\Model\ResourceType;

/**
 * Outbound port: checks whether a bearer token holder has the required permissions
 * on a resource or resource type in the IAM.
 */
interface PermissionCheckerInterface
{
    /**
     * Returns true if the bearer token holder has ALL of the given permissions
     * on the specified resource or resource type.
     *
     * @param string[] $permissions
     */
    public function check(Resource|ResourceType $subject, array $permissions, string $bearerToken): bool;

    /**
     * Returns true if the bearer token holder belongs to the given principal group slug.
     * Example slug: 'reef:iam:principals:super-admin'.
     */
    public function checkGroup(string $groupSlug, string $bearerToken): bool;
}
