from .models import Document
from .util import now

def publish(batch, publisher, tenant_id):
    accepted=[d for d in batch if d.tenant_id==tenant_id and d.acl.tenant_id==tenant_id and not d.deleted]
    publisher.upsert(accepted)
    return {"published":len(accepted),"rejected":len(batch)-len(accepted),"tenant_id":tenant_id,"at":now()}

def deletion(ids,publisher,tenant_id): publisher.delete(ids,tenant_id); return {"deleted":len(ids),"tenant_id":tenant_id,"at":now()}

def audit(event,run_id,tenant_id): return {"event":event,"run_id":run_id,"tenant_id":tenant_id,"at":now()}

class GovernedPublisher:
    def __init__(self, publisher, audit_log=None):
        self.publisher = publisher
        self.audit_log = audit_log if audit_log is not None else []

    def publish(self, batch):
        for doc in getattr(batch, "documents", []):
            if getattr(doc, "tenant_id", None) != getattr(batch, "tenant_id", None):
                raise PermissionError("Tenant isolation failure")
        return publish(getattr(batch, "documents", []), self.publisher, batch.tenant_id)