package auth

import (
	"strings"

	"git.sendico.io/tech/sxchnge/bff/pkg/db/repository/builder"
	"git.sendico.io/tech/sxchnge/bff/pkg/merrors"
	"go.mongodb.org/mongo-driver/v2/bson"
)

// denyImmutablePatch returns ErrInvalidArg if patch touches any field whose
// mutation would silently undermine future access decisions.
func denyImmutablePatch(patch builder.Patch) error {
	if patch == nil {
		return nil
	}
	for _, op := range patch.Build() {
		fields, ok := op.Value.(bson.D)
		if !ok {
			continue
		}
		for _, f := range fields {
			if f.Key == "owner" || strings.HasPrefix(f.Key, "owner.") ||
				f.Key == "organizationRef" || f.Key == "permissionRef" {
				return merrors.InvalidArgumentf("patch field %q is immutable", f.Key)
			}
		}
	}
	return nil
}