'use strict';
// Check the signed effective policy before any enrollment state or browser
// settings are committed. A valid fleet signature alone is not device binding.
function assertPolicyAssignment(policy, deviceId) {
  if (policy.assignment && policy.assignment.deviceId !== deviceId) {
    throw Error('Policy device assignment rejected');
  }
  return policy;
}
module.exports = {assertPolicyAssignment};