/**
 * Checks an authenticated caller's permissions. Routes call it where the
 * answer depends on more than the permission, such as "the owner, or a
 * moderator"; `requirePermission` gates a whole route instead.
 *
 * @module
 */

import { hasPermission, type Permission } from "../../shared/permissions.ts";
import type { AuthPayload } from "../model/auth.ts";

/**
 * Checks whether the caller's role grants `permission`. The role is the live
 * one `authenticate` put in the payload, not the token's.
 */
export function can(payload: AuthPayload, permission: Permission): boolean {
  return hasPermission(payload.role, permission);
}