package com.atlassian.bitbucket.mesh.auth;

import javax.annotation.Nonnull;
import javax.annotation.Nullable;

/**
 * @since 1.4
 */
public interface AuthorisationManager {

    /**
     * Checks whether the authenticated {@link Principal} for the current request has the provided application role,
     * and throws an {@link AuthorisationException} if authentication is enabled <em>and</em> the current request was
     * anonymous, or the authenticated {@link Principal} does not have the required role.
     * <p>
     * If authentication is disabled this method never throws.
     *
     * @param role the role the authenticated {@link Principal} for the current request must have
     * @throws AuthorisationException if the request was anonymous, or if the authenticated {@link Principal} does
     *                                not have the required role
     */
    void checkHasRole(@Nonnull ApplicationRole role, @Nullable String operationName);

    /**
     * Checks whether the authenticated {@link Principal} for the current request has the provided application role.
     *
     * @param role the application role
     * @return {@code true} if authentication has been disabled, or if the current request is authenticated
     *         and the authenticated {@link Principal} has the role; otherwise {@code false}
     */
    boolean hasRole(@Nonnull ApplicationRole role);
}
