package useCases

import (
	"RenewCMS/internal/domain/apikey"
	"RenewCMS/internal/domain/audit"
	"RenewCMS/internal/domain/role"
	"context"
	"time"
)

type RevokeAPIKeyUseCase struct {
	apiKeyRepository apikey.Repository
	now              func() time.Time
	recorder         audit.Recorder
}

func NewRevokeAPIKeyUseCase(apiKeyRepository apikey.Repository, now func() time.Time, recorder audit.Recorder) *RevokeAPIKeyUseCase {
	return &RevokeAPIKeyUseCase{apiKeyRepository, now, recorder}
}

func (r *RevokeAPIKeyUseCase) RevokeAPIKey(ctx context.Context, requesterId uint32, keyId uint32, grants role.GrantSet) error {
	scope := grants.Scope(role.KeyAPIKeysRevoke)
	if scope == role.ScopeNone {
		return role.MissingPermissionError{Key: role.KeyAPIKeysRevoke}
	}

	key, err := r.apiKeyRepository.Get(keyId)
	if err != nil {
		return err
	}

	if scope != role.ScopeAll && key.UserID != requesterId {
		return apikey.ErrAPIKeyNotFound
	}

	if key.RevokedAt != nil {
		return nil
	}

	if err := r.apiKeyRepository.Revoke(key.ID, r.now()); err != nil {
		return err
	}

	event := audit.NewEvent(audit.ActionAPIKeyRevoke, audit.CategoryAPIKeys)
	event.Target = audit.APIKeyTarget(key.ID, key.Name)
	r.recorder.Record(ctx, event)
	return nil
}