package useCases

import (
	"RenewCMS/internal/domain/role"
	"RenewCMS/internal/domain/user"
	"errors"
)

type CheckPermissionUseCase struct {
	roles role.Repository
}

func NewCheckPermissionUseCase(roles role.Repository) *CheckPermissionUseCase {
	return &CheckPermissionUseCase{roles: roles}
}

func (c *CheckPermissionUseCase) Require(account user.User, key string) (role.GrantSet, error) {
	grants, err := c.grantsOf(account, key)
	if err != nil {
		return nil, err
	}
	if !grants.Holds(key) {
		return nil, role.MissingPermissionError{Key: key}
	}
	return grants, nil
}

func (c *CheckPermissionUseCase) RequireAll(account user.User, key string) (role.GrantSet, error) {
	grants, err := c.grantsOf(account, key)
	if err != nil {
		return nil, err
	}
	if !grants.HoldsAll(key) {
		return nil, role.MissingPermissionError{Key: key}
	}
	return grants, nil
}

func (c *CheckPermissionUseCase) grantsOf(account user.User, key string) (role.GrantSet, error) {
	resolved, err := resolveRole(c.roles, account)
	if errors.Is(err, role.ErrRoleNotFound) {
		return nil, role.MissingPermissionError{Key: key}
	}
	if err != nil {
		return nil, err
	}
	granted, err := c.roles.ListGrants(resolved.ID)
	if errors.Is(err, role.ErrRoleNotFound) {
		return nil, role.MissingPermissionError{Key: key}
	}
	if err != nil {
		return nil, err
	}
	return role.NewGrantSet(granted), nil
}