<?php

declare(strict_types=1);

namespace WorkforceOS\Middleware;

final class TenantIsolation
{
    public function assertTenantAccess(array $user, int $tenantId): void
    {
        if (($user['is_super_admin'] ?? false) === true) {
            return;
        }

        if (($user['tenant_id'] ?? null) !== $tenantId) {
            throw new \RuntimeException('Tenant access denied.');
        }
    }
}
