from app.core.contracts import AgentDefinition, RequestContext
from app.core.errors import ForbiddenAgentError


class AgentAuthorizer:
    @staticmethod
    def ensure_allowed(definition: AgentDefinition, context: RequestContext) -> None:
        if not set(definition.allowed_roles).intersection(context.roles):
            raise ForbiddenAgentError("当前角色不能使用此 Agent")
        if context.portal not in definition.allowed_portals:
            raise ForbiddenAgentError("当前入口不能使用此 Agent")
        permission = "agent:run"
        if permission not in context.permissions:
            raise ForbiddenAgentError("缺少 Agent 运行权限")