"""Medical record access policies — Phase 13.5."""
from __future__ import annotations

from uuid import UUID

from shared.exceptions import ForbiddenError


class MedicalRecordAccessPolicy:
    def ensure_read_access(
        self,
        *,
        access_policy: dict | None,
        actor_user_id: str,
        doctor_id: UUID | None = None,
    ) -> None:
        if not access_policy:
            return
        allowed_doctors = access_policy.get("allowed_doctor_ids") or []
        if allowed_doctors and doctor_id and str(doctor_id) not in allowed_doctors:
            if actor_user_id not in (access_policy.get("break_glass_users") or []):
                raise ForbiddenError(
                    "دسترسی به پرونده پزشکی مجاز نیست",
                    error_code="medical_record_access_denied",
                )
