# Author: Sandeep Belgavi
"""Offline delegated authorization. Claims are fixtures, not authenticated tokens."""
from dataclasses import dataclass
import json


@dataclass(frozen=True)
class Claims:
    issuer: str
    audience: str
    subject: str
    actor: str
    tenant: str
    scopes: frozenset
    expires: int


class Gateway:
    def __init__(self, adapter):
        self.adapter = adapter
        self.audit = []

    def call(self, claims, tool, tenant, target, now):
        reason = None
        if claims.issuer != 'fixture-issuer' or claims.audience != 'incident-gateway': reason = 'token-boundary'
        elif not claims.subject or claims.actor != 'incident-agent': reason = 'delegation'
        elif now >= claims.expires: reason = 'expired'
        elif tenant != claims.tenant: reason = 'tenant'
        elif tool != 'read_health' or 'health:read' not in claims.scopes: reason = 'scope'
        elif target not in {'worker-7', 'worker-8'}: reason = 'target'
        self.audit.append({'actor': claims.actor, 'subject': claims.subject, 'tool': tool, 'allowed': reason is None, 'reason': reason})
        if reason: raise PermissionError(reason)
        # Real transport must authenticate claims before this policy function.
        return self.adapter.read_health(tenant, target)


class HealthAdapter:
    """Provider seam; no network, credentials, arbitrary URL or shell input."""
    def __init__(self): self.calls = 0
    def read_health(self, tenant, target):
        self.calls += 1
        return {'target': target, 'status': 'degraded', 'source': 'synthetic-fixture'}


def fixture_claims():
    return Claims('fixture-issuer', 'incident-gateway', 'operator-3', 'incident-agent', 'team-a', frozenset({'health:read'}), 200)


def demo():
    provider = HealthAdapter(); gateway = Gateway(provider)
    result = gateway.call(fixture_claims(), 'read_health', 'team-a', 'worker-7', 100)
    try: gateway.call(fixture_claims(), 'restart_worker', 'team-a', 'worker-7', 100)
    except PermissionError: pass
    return {'status': result['status'], 'provider_calls': provider.calls, 'denied': sum(not item['allowed'] for item in gateway.audit)}


if __name__ == '__main__': print(json.dumps(demo(), sort_keys=True))