namespace SIGCM2.Application.Common;

/// <summary>
/// UDT-009: Resolves effective permissions as (rolPermisos ∪ grant) \ deny.
/// Static helper — no dependencies, pure algorithm, freely testable.
/// </summary>
public static class PermisoResolver
{
    /// <summary>
    /// Returns the effective permission set for a user.
    /// Algorithm: start with role permissions, add grant, remove deny.
    /// Deny always wins over grant (last operation). Idempotent on duplicates.
    /// Never throws.
    /// </summary>
    public static IReadOnlySet<string> Resolve(
        IEnumerable<string> rolPermisos,
        PermisosOverride overrides)
    {
        var set = new HashSet<string>(rolPermisos, StringComparer.Ordinal);

        foreach (var g in overrides.Grant)
            set.Add(g);

        foreach (var d in overrides.Deny)
            set.Remove(d);

        return set;
    }
}
