<?php

declare(strict_types=1);

namespace KTXC\Service;

use KTXC\Models\Firewall\FirewallRuleObject;

final class FirewallRuleScope
{
    private function __construct(
        public readonly string $scope,
        public readonly ?string $tenantId,
    ) {
    }

    public static function tenant(string $tenantId): self
    {
        if ($tenantId === '') {
            throw new \InvalidArgumentException('Tenant firewall rule scope requires a tenant ID.');
        }

        return new self(FirewallRuleObject::SCOPE_TENANT, $tenantId);
    }

    public static function system(): self
    {
        return new self(FirewallRuleObject::SCOPE_SYSTEM, null);
    }

    public function owns(FirewallRuleObject $rule): bool
    {
        return $rule->getScope() === $this->scope && $rule->getTenantId() === $this->tenantId;
    }
}