defmodule Mv.Authorization.Checks.ActorIsNil do
  @moduledoc """
  Policy check: true only when the actor is nil (unauthenticated).

  Used for the public join flow so that submit and confirm actions are allowed
  only when called without an authenticated user (e.g. from the public /join form
  and confirmation link). See docs/onboarding-join-concept.md.
  """
  use Ash.Policy.SimpleCheck

  @impl true
  def describe(_opts), do: "actor is nil (unauthenticated)"

  @impl true
  def match?(nil, _context, _opts), do: true
  def match?(_actor, _context, _opts), do: false
end