package kb

import (
	"context"
	"log/slog"
	"strings"
)

func (s *KBService) canAdministerWorkspace(ctx context.Context, workspaceID, subject string) (bool, error) {
	if s.workspaceGovernanceAuthorizer == nil {
		return false, nil
	}
	return s.workspaceGovernanceAuthorizer.CanAdministerWorkspace(
		ctx,
		strings.TrimSpace(workspaceID),
		strings.TrimSpace(subject),
	)
}

// Capability hydration must not make a readable KB or Dashboard unavailable
// when the AgentTeam authority read is temporarily unavailable. Mutations call the
// strict helper above and still fail closed.
func (s *KBService) canAdministerWorkspaceForRead(ctx context.Context, workspaceID, subject string) bool {
	allowed, err := s.canAdministerWorkspace(ctx, workspaceID, subject)
	if err != nil {
		s.logger.WarnContext(ctx, "hydrate KB workspace governance capability", slog.String("workspace_id", strings.TrimSpace(workspaceID)), slog.Any("error", err))
		return false
	}
	return allowed
}