package access

import (
	"git.iwork-ai.com/xdc/iqudo-top1/internal/auth"
	"git.iwork-ai.com/xdc/iqudo-top1/internal/model"
	"gorm.io/gorm"
)

func ScopeScenarios(query *gorm.DB, principal auth.Principal, alias string) *gorm.DB {
	if auth.HasPermission(principal, "*") {
		return query.Where(alias+".tenant_id = ?", principal.TenantID)
	}
	teamVisible := auth.HasPermission(principal, "scenario.team_view")
	return query.Where(
		alias+".tenant_id = ? AND ("+alias+".visibility = ? OR "+alias+".created_by = ? OR ("+alias+".visibility = ? AND ?))",
		principal.TenantID, "tenant", principal.UserID, "team", teamVisible,
	)
}

func CanViewScenario(db *gorm.DB, principal auth.Principal, scenarioID uint64) bool {
	var count int64
	query := ScopeScenarios(db.Model(&model.Scenario{}), principal, "scenarios")
	if err := query.Where("scenarios.id = ? AND scenarios.status <> ?", scenarioID, "archived").Count(&count).Error; err != nil {
		return false
	}
	return count == 1
}

func CanEditScenario(db *gorm.DB, principal auth.Principal, scenarioID uint64) bool {
	if !auth.HasPermission(principal, "scenario.edit") && !auth.HasPermission(principal, "*") {
		return false
	}
	return CanViewScenario(db, principal, scenarioID)
}

func CanViewSOP(db *gorm.DB, principal auth.Principal, sopID uint64) bool {
	var count int64
	query := db.Table("sops s").Joins("JOIN scenarios sc ON sc.id = s.scenario_id")
	query = ScopeScenarios(query, principal, "sc")
	if err := query.Where("s.id = ? AND s.tenant_id = ? AND s.status <> ?", sopID, principal.TenantID, "archived").Count(&count).Error; err != nil {
		return false
	}
	return count == 1
}

func CanEditSOP(db *gorm.DB, principal auth.Principal, sopID uint64) bool {
	if !auth.HasPermission(principal, "sop.edit") && !auth.HasPermission(principal, "*") {
		return false
	}
	return CanViewSOP(db, principal, sopID)
}