package handler

import (
	"codeberg.org/VARASYS/ZDDC/zddc/internal/zddc"
)

// hasAnyAdminScope reports whether p has EFFECTIVE admin authority
// anywhere in the tree. Returns false for an un-elevated principal
// regardless of what the cascade names — the gate is in zddc.Principal
// itself. For the "could this user opt into admin powers?" question
// (elevation-INDEPENDENT), use zddc.HasAnyAdminGrant directly.
func hasAnyAdminScope(fsRoot string, p zddc.Principal) bool {
	if !p.Elevated {
		return false
	}
	return zddc.HasAnyAdminGrant(fsRoot, p.Email)
}