"""Machine-principal and project/environment binding checks."""

from __future__ import annotations

from datetime import UTC, datetime

from .errors import ACCESS_DENIED
from .models import AliasRecord, PrincipalLike


class AliasAuthorizer:
    def authorize(
        self, principal: PrincipalLike, record: AliasRecord, *, now: datetime | None = None
    ) -> None:
        reference = now or datetime.now(UTC)
        if principal.kind != "machine_client" or principal.client_id is None:
            raise ACCESS_DENIED
        if principal.expires_at <= reference:
            raise ACCESS_DENIED
        for binding in record.bindings:
            if (
                binding.enabled
                and binding.client_id == principal.client_id
                and binding.issuer == principal.issuer
                and binding.subject == principal.subject
            ):
                if not record.enabled:
                    raise ACCESS_DENIED
                return
        raise ACCESS_DENIED