defmodule Mv.Authorization.Checks.OidcOnlyActive do
  @moduledoc """
  Policy check: true when OIDC-only mode is active (Config.oidc_only?()).

  Used to forbid password sign-in when only OIDC (SSO) sign-in is allowed.
  """
  use Ash.Policy.SimpleCheck

  alias Mv.Config

  @impl true
  def describe(_opts), do: "OIDC-only mode is active"

  @impl true
  def match?(_actor, _context, _opts), do: Config.oidc_only?()
end