<?php

declare(strict_types=1);

namespace App\Framework\Auth;

use App\Framework\Auth\ValueObjects\NamespaceAccessPolicy;
use App\Framework\Config\TypedConfiguration;
use App\Framework\DI\Attributes\Initializer;
use App\Framework\DI\Container;

final readonly class RouteAuthorizationServiceInitializer
{
    public function __construct(
        private TypedConfiguration $config
    ) {
    }

    #[Initializer]
    public function __invoke(Container $container): RouteAuthorizationService
    {
        // Configure namespace-based access control
        $namespaceConfig = [
            // Example: Block all Admin controllers by default
            // 'App\Application\Admin\*' => [
            //     'visibility' => 'admin',  // IP-based restriction
            //     'access_policy' => NamespaceAccessPolicy::blocked()  // Block all
            // ],

            // Example: Block Admin except specific controllers
            // 'App\Application\Admin\*' => [
            //     'visibility' => 'public',
            //     'access_policy' => NamespaceAccessPolicy::blockedExcept(
            //         \App\Application\Admin\LoginController::class,
            //         \App\Application\Admin\HealthCheckController::class
            //     )
            // ],

            // Example: IP restriction only (no namespace blocking)
            // 'App\Application\Admin\*' => [
            //     'visibility' => 'admin',  // Only admin IPs allowed
            // ],
        ];

        return new RouteAuthorizationService(
            config: $this->config,
            namespaceConfig: $namespaceConfig
        );
    }
}
