src/access/examples/GroupAuxiliaryAccessControlDelegateImpl.h

/*
 *
 *    Copyright (c) 2026 Project CHIP Authors
 *    All rights reserved.
 *
 *    Licensed under the Apache License, Version 2.0 (the "License");
 *    you may not use this file except in compliance with the License.
 *    You may obtain a copy of the License at
 *
 *        http://www.apache.org/licenses/LICENSE-2.0
 *
 *    Unless required by applicable law or agreed to in writing, software
 *    distributed under the License is distributed on an "AS IS" BASIS,
 *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *    See the License for the specific language governing permissions and
 *    limitations under the License.
 */

#pragma once

#include <access/GroupAuxiliaryAccessControlDelegate.h>
#include <credentials/GroupDataProvider.h>
#include <lib/core/DataModelTypes.h>

namespace chip {

class FabricTable;

namespace Access {
namespace Examples {

/**
 * Default SDK implementation of GroupAuxiliaryAccessControlDelegate.
 *
 * Reports auxiliary ACL entries for every <fabricIndex, groupId, endpointId>
 * triple derived from the supplied GroupDataProvider. This is the simplest
 * "base case" shape of an auxiliary ACL entry set; products that need a
 * different layout should subclass GroupAuxiliaryAccessControlDelegate
 * directly rather than reusing this class.
 */
class GroupAuxiliaryAccessControlDelegateImpl : public GroupAuxiliaryAccessControlDelegate
{
public:
    GroupAuxiliaryAccessControlDelegateImpl()           = default;
    ~GroupAuxiliaryAccessControlDelegateImpl() override = default;

    CHIP_ERROR Initialize(Credentials::GroupDataProvider * groupDataProvider, FabricTable * fabricTable) override;
    void Shutdown() override;
    bool IsInitialized() const override { return mGroupDataProvider != nullptr; }

    // AccessControl::Delegate
    CHIP_ERROR AuxiliaryEntries(AccessControl::EntryIterator & iterator, const FabricIndex * fabricIndex) const override;
    CHIP_ERROR Check(const SubjectDescriptor & subjectDescriptor, const RequestPath & requestPath,
                     Privilege requestPrivilege) override;

private:
    Credentials::GroupDataProvider * mGroupDataProvider = nullptr;
    FabricTable * mFabricTable                          = nullptr;
};

} // namespace Examples
} // namespace Access
} // namespace chip