Kairo-Jinkendo/backend/entitlements.py

"""Entitlements snapshot for GET /api/me/entitlements."""

from __future__ import annotations

from typing import Any

from capabilities import capability_enforcement_mode, check_capability
from rights_registry import get_registered_capabilities
from tenant_context import TenantContext


def _capability_map(ctx: TenantContext) -> dict[str, dict[str, Any]]:
    registered = {reg.key for reg in get_registered_capabilities()}
    snapshot: dict[str, dict[str, Any]] = {}
    for key in sorted(registered):
        snapshot[key] = check_capability(ctx, key)
    return snapshot


def build_entitlements_snapshot(ctx: TenantContext) -> dict[str, Any]:
    tenant_block = None
    if ctx.tenant_id:
        tenant_block = {
            "tenant_id": ctx.tenant_id,
            "slug": ctx.tenant_slug,
            "name": ctx.tenant_name,
            "role": ctx.tenant_role,
            "capabilities": {
                key: value
                for key, value in _capability_map(ctx).items()
                if key in ctx.capabilities
            },
            "features": {},
        }

    return {
        "account": {
            "user_id": ctx.user_id,
            "email": ctx.email,
            "display_name": ctx.display_name,
            "portal_role": ctx.portal_role,
            "capabilities": _capability_map(ctx),
            "features": {},
        },
        "tenant": tenant_block,
        "actor": (
            {
                "actor_id": ctx.actor_id,
                "actor_type": ctx.actor_type,
            }
            if ctx.actor_id
            else None
        ),
        "roles": {
            "portal": ctx.portal_role,
            "tenant": ctx.tenant_role,
        },
        "capabilities": sorted(ctx.capabilities),
        "features": {},
        "enforcement": {
            "capabilities": capability_enforcement_mode(),
            "features": "probe",
        },
    }