package server

import (
	core "git-ssh.u1680832.nyat.app/weichen/Agent-System-Core.git"
)

// projectStreamMembership consults the registered resource authorizer using the
// physical project's trusted owner, never the event publisher or payload claims.
func (s *Server) projectStreamMembership(actor, project string) bool {
	p, err := s.st.ProjectMetadata(project)
	if err != nil {
		return false
	}
	return s.authorizeSharedResource(actor, "stream", "project", project, p.Owner, project)
}

func (s *Server) projectEventVisible(actor string, event core.StreamEvent) bool {
	if s.projectLifecycle == nil {
		return true
	}
	access, err := s.st.ResolveProjectEventAccess(event)
	if err != nil || access.Owner == "" {
		return false
	}
	if access.Owner == actor {
		return true
	}
	project, ok := core.ProjectFromChannel(event.ConversationID)
	return ok && access.Shared && s.projectStreamMembership(actor, project)
}