"""One query implementation, two synthetic provider-controlled access scopes."""
from copy import deepcopy
from dataclasses import dataclass


@dataclass(frozen=True)
class Access:
    order_ids: frozenset[str]
    fields: frozenset[str]


class OrderService:
    def __init__(self, orders, grants):
        self._orders = deepcopy(orders)
        self._grants = dict(grants)
        self.reads = []  # Test observation, not a production audit ledger.

    def get_order(self, caller: str, order_id: str) -> dict:
        access = self._grants.get(caller)
        if access is None or order_id not in access.order_ids:
            raise PermissionError("order not authorized")
        # Check business scope before looking up the record.
        self.reads.append(order_id)
        order = self._orders[order_id]
        return deepcopy({key: value for key, value in order.items() if key in access.fields})


def demo_service() -> OrderService:
    return OrderService(
        {
            "DEMO-42": {
                "order_id": "DEMO-42", "status": "shipped",
                "delivery_note": "Synthetic: reception desk",
                "total": {"amount_cents": 10800, "currency": "USD", "tax_included": True},
                "metric": "order_total_not_booked_revenue",
            },
            "DEMO-43": {
                "order_id": "DEMO-43", "status": "processing",
                "total": {"amount_cents": 5400, "currency": "USD", "tax_included": True},
                "metric": "order_total_not_booked_revenue",
            },
        },
        {
            "demo-sales": Access(frozenset({"DEMO-42"}), frozenset({"order_id", "status", "delivery_note", "total", "metric"})),
            "demo-analysis": Access(frozenset({"DEMO-42", "DEMO-43"}), frozenset({"order_id", "total", "metric"})),
        },
    )


if __name__ == "__main__":
    import json
    service = demo_service()
    for caller in ("demo-sales", "demo-analysis"):
        print(json.dumps({"caller": caller, "result": service.get_order(caller, "DEMO-42")}, ensure_ascii=False))