import type { ShellToolsConfig } from "#src/config-schema";
import type { PermissionCheckResult } from "#src/types";

/** Synthetic rule marker recorded when a shell alias raises allow to ask. */
export const SHELL_TOOL_DECISION_FLOOR_PATTERN = "<shell-tool-decision-floor>";

type ShellDecisionFloor = ShellToolsConfig[string]["decisionFloor"];

/**
 * Enforce the minimum review decision configured for a shell alias.
 *
 * The only supported floor is `ask`: it raises an allow to ask while preserving
 * existing asks and hard denies. The synthetic result no longer reports a
 * session source, so a prior Bash session approval cannot bypass an alias whose
 * contract requires every invocation to enter the authorizer chain.
 */
export function applyShellDecisionFloor(
  check: PermissionCheckResult,
  floor: ShellDecisionFloor,
): PermissionCheckResult {
  if (floor !== "ask" || check.state !== "allow") return check;

  return {
    ...check,
    state: "ask",
    source: "bash",
    matchedPattern: SHELL_TOOL_DECISION_FLOOR_PATTERN,
    reason: undefined,
  };
}
