guard

func (*CompiledPolicy) Evaluate(user Identity, resourceVal reflect.Value, action string) error
{
	// 1. Check Static Rules
	// We need to check exact action match AND wildcard "*" action match.

	allowed := false
	ruleFound := false

	// Helper to check map
	checkStatic := func(act string) {
		if allowedRoles, ok := p.StaticRules[act]; ok {
			ruleFound = true
			// Check if user has any of these roles
			userRoles := user.GetRoles()
			for _, ur := range userRoles {
				if allowedRoles[ur] {
					allowed = true
					return
				}
				// Check if allowedRoles has "*" (wildcard role allowed?)
				if allowedRoles["*"] {
					allowed = true
					return
				}
			}
		}
	}

	checkStatic(action)
	if allowed {
		return nil
	}
	checkStatic("*")
	if allowed {
		return nil
	}

	// 2. Check Dynamic Rules
	for _, rule := range p.DynamicRules {
		// Check if rule applies to this action
		actionMatch := false
		for _, a := range rule.Actions {
			if a == action || a == "*" {
				actionMatch = true
				break
			}
		}

		if actionMatch {
			ruleFound = true
			// Evaluate dynamic role from field
			fieldVal := resourceVal.Field(rule.FieldIndex)
			// Logic from original:
			// if fieldVal is Map, iterate keys/values...
			// "role:*" logic:
			// "If role tag contains '*', the field value(s) are treated as required roles."
			// So we extract roles from fieldVal and check if user has them.

			// Reusing checker logic or similar?
			// Original:
			// if fieldVal.Kind() == reflect.Map ...
			// Simplify: extract roles from fieldVal.

			dynamicRoles := extractRoles(fieldVal, user.GetID())
			userRoles := user.GetRoles()

			// Check intersection
			for _, dr := range dynamicRoles {
				for _, ur := range userRoles {
					if dr == ur {
						allowed = true
						break
					}
				}
				if allowed {
					break
				}
			}
		}
		if allowed {
			break
		}
	}

	if !ruleFound {
		return fmt.Errorf("no policy defined for action '%s'", action)
	}
	if !allowed {
		return fmt.Errorf("permission denied for action '%s'", action)
	}

	return nil
}

func (*Guard) GetRoles(user Identity, resource any) ([]string, error)
{
	if user == nil {
		return nil, errors.New("identity is nil")
	}
	if resource == nil {
		return nil, errors.New("resource is nil")
	}

	val := reflect.ValueOf(resource)
	if val.Kind() == reflect.Ptr {
		val = val.Elem()
	}
	if val.Kind() != reflect.Struct {
		return nil, errors.New("resource must be a struct or pointer to struct")
	}

	// We need to support GetRoles even if the new policy logic is action-centric.
	// But `GetRoles` is about "What roles does this user have on this resource?".
	// The new Policy tracks logic per ACTION.
	// However, we can inspect the policy to see which roles match.
	// OR we can keep the old logic for GetRoles?
	// But optimizing GetRoles is also important if used frequently.
	// But `Can` is the main entry point.
	// Let's implement GetRoles by checking all possible roles in the policy against the user.

	policy := getPolicy(val.Type())

	// Collect matching roles
	matchedRoles := make(map[string]bool)

	// Check user's explicit roles against any static role used in policy?
	// User has roles [A, B].
	// If resource allows A for action Read, then user has role A on this resource.
	// This is vague.
	// `GetRoles` usually returns roles that match dynamic criteria + static ones?
	// Original logic: "If `role:admin` is on field, and user has `admin` global role, then user has `admin` on resource."

	userRoles := user.GetRoles()
	userRolesMap := make(map[string]bool, len(userRoles))
	for _, r := range userRoles {
		userRolesMap[r] = true
	}

	// 1. Static Roles from Policy
	// We don't have a simple list of "All Static Roles" in compiled policy, but we have them in `StaticRules`.
	for _, roleMap := range policy.StaticRules {
		for r := range roleMap {
			if r == "*" {
				continue
			}
			if userRolesMap[r] {
				matchedRoles[r] = true
			}
		}
	}

	// 2. Dynamic Roles
	for _, rule := range policy.DynamicRules {
		fieldVal := val.Field(rule.FieldIndex)
		roles := extractRoles(fieldVal, user.GetID())
		for _, r := range roles {
			// If dynamic role (e.g. from DB) matches user's ID or is in user's roles?
			// `role:*` extraction logic in original checked `fieldVal` against `user.GetID()`.
			// Wait, the new `extractRoles` logic I wrote uses `checker.IsMatch(key, userID)`.
			// So it extracts roles if the KEY matches the user.
			// e.g. `role:*` on `map[string]string`. User ID "123". Map["123"] = "owner".
			// Then "owner" is extracted.
			// Then we check if user HAS role "owner"?
			// Original logic: `userRoles[roleVal.String()] = true`.
			// Yes, so if extracted role is in User's roles, we add it. Or is the extracted string THE role the user has?

			// If `role:*` resolves to "owner", it means "The user with ID matching the key HAS the role 'owner' on this resource".
			// So we add "owner" to `matchedRoles`.
			// We DO NOT check if user already has "owner" in global traits.
			// Validated against original lines 92: `userRoles[roleVal.String()] = true`.

			matchedRoles[r] = true
		}
	}

	roles := make([]string, 0, len(matchedRoles))
	for r := range matchedRoles {
		roles = append(roles, r)
	}
	return roles, nil
}

func (*Guard) Can(user Identity, resource any, action string) error
{
	if user == nil {
		return errors.New("identity is nil")
	}
	if resource == nil {
		return errors.New("resource is nil")
	}

	val := reflect.ValueOf(resource)
	if val.Kind() == reflect.Ptr {
		val = val.Elem()
	}
	if val.Kind() != reflect.Struct {
		return errors.New("resource must be a struct or pointer to struct")
	}

	policy := getPolicy(val.Type())
	return policy.Evaluate(user, val, action)
}