<?php

/**
 * Who may use Tinker Tickets at all. Shared by the web login
 * (AuthMiddleware, from Authelia's Remote-Groups header) and the MCP endpoint
 * (from the OAuth access token's groups claim), so both entry points enforce
 * one rule instead of two copies that can drift apart.
 */
class AccessPolicy
{
    /** Membership in any of these grants access. */
    private const REQUIRED_GROUPS = ['admin', 'employee'];

    /**
     * @param string $groups Comma-separated group names (Remote-Groups format)
     */
    public static function hasAppAccess(string $groups): bool
    {
        if ($groups === '') {
            return false;
        }

        // Filter to safe characters only to prevent header injection attacks
        $userGroups = array_filter(
            array_map('trim', explode(',', strtolower($groups))),
            fn($g) => preg_match('/^[a-z0-9_\-]+$/', $g)
        );

        return !empty(array_intersect($userGroups, self::REQUIRED_GROUPS));
    }
}