/**
 * Authorization primitives shared across services and routes.
 *
 * Pure types + error classes. No NextAuth, no Prisma. Keep this file
 * dependency-free so policy modules and API routes can both import it
 * without picking up framework weight.
 */

export type Role = 'ADMIN' | 'ADMIN_READ_ONLY' | 'EDITOR' | 'VIEWER';

export interface AuthContext {
    userId: number;
    role: Role;
}

export class AuthorizationError extends Error {
    readonly status: number;
    constructor(message = 'Forbidden', status = 403) {
        super(message);
        this.name = 'AuthorizationError';
        this.status = status;
    }
}

export class NotFoundError extends Error {
    readonly status = 404;
    constructor(message = 'Not found') {
        super(message);
        this.name = 'NotFoundError';
    }
}