guard

func (*CompiledPolicy) Evaluate(user Identity, resourceVal reflect.Value, action string) error
{
	allowed := false
	ruleFound := false

	checkStatic := func(act string) {
		if allowedRoles, ok := p.StaticRules[act]; ok {
			ruleFound = true
			userRoles := user.GetRoles()
			for _, ur := range userRoles {
				if allowedRoles[ur] {
					allowed = true
					return
				}
				if allowedRoles["*"] {
					allowed = true
					return
				}
			}
		}
	}

	checkStatic(action)
	if allowed {
		return nil
	}
	checkStatic("*")
	if allowed {
		return nil
	}

	ruleIndices := p.actionIndex[action]
	rRuleIndices := make([]int, len(ruleIndices))
	copy(rRuleIndices, ruleIndices)
	rRuleIndices = append(rRuleIndices, p.wildcardIndex...)

	for _, idx := range rRuleIndices {
		if idx >= len(p.DynamicRules) {
			continue
		}
		rule := p.DynamicRules[idx]
		ruleFound = true
		fieldVal := resourceVal.Field(rule.FieldIndex)
		dynamicRoles := extractRoles(fieldVal, user.GetID())
		userRoles := user.GetRoles()

		for _, dr := range dynamicRoles {
			for _, ur := range userRoles {
				if dr == ur {
					allowed = true
					break
				}
			}
			if allowed {
				break
			}
		}
		if allowed {
			break
		}
	}

	if !ruleFound {
		return fmt.Errorf("no policy defined for action '%s'", action)
	}
	if !allowed {
		return fmt.Errorf("permission denied for action '%s'", action)
	}

	return nil
}

func (*Guard) GetRoles(user Identity, resource any) ([]string, error)
{
	if user == nil {
		return nil, errors.New("identity is nil")
	}
	if resource == nil {
		return nil, errors.New("resource is nil")
	}

	val := reflect.ValueOf(resource)
	if val.Kind() == reflect.Ptr {
		val = val.Elem()
	}
	if val.Kind() != reflect.Struct {
		return nil, errors.New("resource must be a struct or pointer to struct")
	}

	policy := getPolicy(val.Type())
	matchedRoles := make(map[string]bool)

	userRoles := user.GetRoles()
	userRolesMap := make(map[string]bool, len(userRoles))
	for _, r := range userRoles {
		userRolesMap[r] = true
	}

	for _, roleMap := range policy.StaticRules {
		for r := range roleMap {
			if r == "*" {
				continue
			}
			if userRolesMap[r] {
				matchedRoles[r] = true
			}
		}
	}

	for _, rule := range policy.DynamicRules {
		fieldVal := val.Field(rule.FieldIndex)
		roles := extractRoles(fieldVal, user.GetID())
		for _, r := range roles {
			matchedRoles[r] = true
		}
	}

	roles := make([]string, 0, len(matchedRoles))
	for r := range matchedRoles {
		roles = append(roles, r)
	}
	return roles, nil
}

func (*Guard) Can(user Identity, resource any, action string) error
{
	if user == nil {
		return errors.New("identity is nil")
	}
	if resource == nil {
		return errors.New("resource is nil")
	}

	val := reflect.ValueOf(resource)
	if val.Kind() == reflect.Ptr {
		val = val.Elem()
	}
	if val.Kind() != reflect.Struct {
		return errors.New("resource must be a struct or pointer to struct")
	}

	policy := getPolicy(val.Type())
	return policy.Evaluate(user, val, action)
}