<?php

namespace App\Policies;

use App\Models\Project;
use App\Models\ProjectFile;
use App\Models\User;

class ProjectFilePolicy
{
    /**
     * Guards against IDOR: a file only downloads through the project it actually belongs to.
     */
    public function download(User $user, ProjectFile $file, Project $project): bool
    {
        return $user->role === 'admin' && $file->revision->project_id === $project->id;
    }

    /**
     * Same IDOR guard as download(): generating or viewing a rendered preview
     * must only ever be reachable through the project the file actually belongs to.
     */
    public function render(User $user, ProjectFile $file, Project $project): bool
    {
        return $user->role === 'admin' && $file->revision->project_id === $project->id;
    }
}