"""Original synthetic authorisation model. No network calls or actual email."""
from dataclasses import dataclass

@dataclass(frozen=True)
class Job:
    tenant: str
    user: str
    recipient: str
    allowed_documents: frozenset
    action: str

JOB=Job('tenant-A','alice','customer@example.invalid',frozenset({'order-17'}),'draft')

def decision(job, proposal, current_permission=True):
    if not current_permission:
        return 'deny: permission withdrawn'
    if proposal['action'] != job.action:
        return 'deny: action outside job'
    if proposal['recipient'] != job.recipient:
        return 'deny: recipient outside job'
    if not set(proposal['documents']).issubset(job.allowed_documents):
        return 'deny: document outside job'
    return 'allow proposal within job'

CASES=[
 ('authorised draft',{'action':'draft','recipient':'customer@example.invalid','documents':['order-17']},True,'allow proposal within job'),
 ('substituted recipient',{'action':'draft','recipient':'archive@example.invalid','documents':['order-17']},True,'deny: recipient outside job'),
 ('send instead of draft',{'action':'send','recipient':'customer@example.invalid','documents':['order-17']},True,'deny: action outside job'),
 ('extra document',{'action':'draft','recipient':'customer@example.invalid','documents':['order-17','staff-9']},True,'deny: document outside job'),
 ('revoked permission',{'action':'draft','recipient':'customer@example.invalid','documents':['order-17']},False,'deny: permission withdrawn'),
]
if __name__=='__main__':
    for label,proposal,permission,expected in CASES:
        actual=decision(JOB,proposal,permission)
        assert actual==expected,(label,actual)
        print(label,':',actual)
    print('5/5 policy assertions passed. No model behaviour was evaluated.')