<?php

namespace App\Services\Auth;

use App\Enums\UserRole;
use App\Models\User;

class AuthorizationService
{
    public function can(User $user, string $permission): bool
    {
        if (! $user->is_active) {
            return false;
        }

        // Manager role has full platform access by business rule.
        if ($user->hasRole(UserRole::Manager->value)) {
            return true;
        }

        return $user->hasPermission($permission);
    }
}
