defmodule Mv.Authorization.Checks.ActorIsSystemUser do
  @moduledoc """
  Policy check: true only when the actor is the system user (e.g. system@mila.local).

  Used to restrict internal actions (e.g. Member.set_vereinfacht_contact_id) so that
  only code paths using SystemActor can perform them, not regular admins.
  """
  use Ash.Policy.SimpleCheck

  @impl true
  def describe(_opts), do: "actor is the system user"

  @impl true
  def match?(actor, _context, _opts), do: Mv.Helpers.SystemActor.system_user?(actor)
end
