"""Request identity and scope used by all DataOps MCP tools."""

from dataclasses import dataclass


@dataclass(frozen=True)
class AgentIdentity:
    subject: str
    roles: frozenset
    business_domains: frozenset
    environments: frozenset
    correlation_id: str

    def require_domain(self, domain):
        if "*" not in self.business_domains and domain not in self.business_domains:
            raise PermissionError("business domain is outside identity scope")

    def require_environment(self, environment):
        if "*" not in self.environments and environment not in self.environments:
            raise PermissionError("environment is outside identity scope")

    def has_any_role(self, roles):
        return bool(self.roles.intersection(roles))