//! [`NoopSandbox`] — the no-op [`SandboxEnforcer`] for platforms without an OS
//! sandbox (Windows, macOS) and the universal fallback (lot LP4-1).
//!
//! It compiles **everywhere** and never restricts anything: `enforce` always
//! returns [`SandboxStatus::Unsupported`] and never errors. The caller keeps the
//! advisory LP3 projection as its only guard.

use domain::sandbox::{SandboxEnforcer, SandboxError, SandboxKind, SandboxPlan, SandboxStatus};

/// A [`SandboxEnforcer`] that enforces nothing (non-Linux / fallback).
#[derive(Debug, Default, Clone, Copy)]
pub struct NoopSandbox;

impl NoopSandbox {
    /// Builds the no-op enforcer.
    #[must_use]
    pub fn new() -> Self {
        Self
    }
}

impl SandboxEnforcer for NoopSandbox {
    fn kind(&self) -> SandboxKind {
        SandboxKind::Unsupported
    }

    fn enforce(&self, _plan: &SandboxPlan) -> Result<SandboxStatus, SandboxError> {
        // No OS sandbox here: nothing enforced, never an error (the fail-closed
        // posture handling is a Landlock-only concern; on an unsupported platform
        // there is nothing to fail closed *against*).
        Ok(SandboxStatus::Unsupported)
    }
}