"""Synthetic permission-boundary experiment. No LLM, network or customer data.
Run: python permission-boundary-demo.py
This is a teaching model, not a production security component.
"""
import json
import platform

USERS = {'sales-user': 'sales', 'hr-user': 'hr'}
DOCUMENTS = {'sales-plan': 'sales', 'hr-plan': 'hr'}

def allow(user, action, document, approved_request=None):
    department = USERS.get(user)
    if department is None or DOCUMENTS.get(document) != department:
        return False
    if action == 'read':
        return True
    # In this toy model, approval is trusted test input from a separate approver.
    # Production requires authenticated, expiring, one-use approvals bound to
    # the exact payload, recipient and request; callers must not self-approve.
    if action == 'send':
        return approved_request == (user, action, document)
    return False

CASES = [
    ('allowed_read', 'sales-user', 'read', 'sales-plan', None, True),
    ('cross_department_read', 'sales-user', 'read', 'hr-plan', None, False),
    ('unknown_user', 'unknown', 'read', 'sales-plan', None, False),
    ('unknown_document', 'sales-user', 'read', 'missing', None, False),
    ('unapproved_send', 'sales-user', 'send', 'sales-plan', None, False),
    ('approved_send', 'sales-user', 'send', 'sales-plan', ('sales-user', 'send', 'sales-plan'), True),
    ('mismatched_approval', 'sales-user', 'send', 'sales-plan', ('hr-user', 'send', 'hr-plan'), False),
    ('unknown_action', 'sales-user', 'delete', 'sales-plan', None, False),
]

if __name__ == '__main__':
    results = []
    for name, user, action, document, approval, expected in CASES:
        actual = allow(user, action, document, approval)
        results.append({'case': name, 'expected': expected, 'actual': actual, 'passed': actual == expected})
    output = {'environment': f'Python {platform.python_version()} / {platform.system()}',
              'scope': 'Synthetic deterministic model; no LLM or external I/O', 'results': results}
    print(json.dumps(output, ensure_ascii=False, indent=2))
    raise SystemExit(0 if all(row['passed'] for row in results) else 1)