import type { Actor } from './model.js'
import { FieldAuthorizationError } from './errors.js'

// CAPABILITY authz only. Object-level ownership (does this actor own entityId?) is the HOST's
// obligation BEFORE calling set/deleteEntityValues — the engine has no owner column (spec §5).
export function assertCanEditFields(actor: Actor): void {
  if (!actor.canEditFields) throw new FieldAuthorizationError(actor.id, 'editFields')
}
export function assertCanManageGroups(actor: Actor): void {
  if (!actor.canManageGroups) throw new FieldAuthorizationError(actor.id, 'manageGroups')
}