const {
  grant, // allow or deny access
  filter, // generate DB query filters
  projection, // show or hide document properties
  setter, // set document properties
} = pdp.can(
  ['editor', 'publisher'], // the user's roles
  'article:publish', // the operation to check
  {
    user: { _id: 'some-user-id-003' },
    document: {
      published: false,
      createdBy: 'other-user-id-007',
    },
  } // attributes of user, document or context
)

import PDP from '@policer-io/pdp-ts'

type RoleName = 'reader' | 'editor' | 'publisher'

const pdp = await PDP.create<RoleName>({
  applicationId: '65f0674f39d8a1a5ef805ca7',
  hostname: 'cloud.policer.io',
})

//// 1. prepare policy decision inputs

/** the user's roles */
const roles: RoleName[] = ['editor', 'publisher']
/** the operation to check */
const operation: string = 'article:publishBatch'
/** attributes of user, document or context */
const attributes: Record<string, unknown> = {
  user: {
    _id: 'some-user-id-003',
    magazine: 'The New Yorker',
  },
  document: {
    published: false,
    createdBy: 'other-user-id-007',
  },
}

//// 2. perform policy decision/check

const { grant, filter, projection, setter } = pdp.can(roles, operation, attributes)

//// 3. use policy decision result

if (grant) {
  // if authorized

  // query documents and document properties based on policy decision result (`filter` & `projection`)
  const articles = await db.articles.find({ $and: [{ status: 'ready' }, filter] }, projection).exec()

  // set or overwrite some document fields based on policy decision result (`setter`), for example `article.magazine`
  articles.forEach((article) => {
    publish({ ...article, ...setter })
  })
} else {
  // if not authorized

  throw new Error('403 Forbidden')
}