package test

import (
	"RenewCMS/api/pkg/access"
	"RenewCMS/api/pkg/claims"
	"RenewCMS/internal/domain/role"
	"RenewCMS/internal/infrastructure/useCases"
	"errors"
	"net/http"
	"os"
	"strings"
	"testing"
)

func grantRows(rows ...string) []role.Grant {
	grants := make([]role.Grant, 0, len(rows))
	for _, row := range rows {
		key, scope, found := strings.Cut(row, "=")
		if !found {
			panic("grant row without a scope: " + row)
		}
		grants = append(grants, role.Grant{Key: key, Scope: role.Scope(scope)})
	}
	return grants
}

func unlockedGrantSet(rows ...string) role.GrantSet {
	return role.Role{Grants: grantRows(rows...)}.GrantSet()
}

func requireMissingKey(t *testing.T, err error, key string) {
	t.Helper()
	if !errors.Is(err, role.ErrMissingPermission) || missingKeyOf(t, err) != key {
		t.Fatalf("expected missing permission %q, got %v", key, err)
	}
}

func readTestFile(t *testing.T, path string) string {
	t.Helper()
	content, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	return string(content)
}

func ownerCaller(userID uint32) useCases.ContentCaller {
	return useCases.ContentCaller{UserID: userID, Grants: role.BuiltInRoles()[0].GrantSet()}
}

func callerWith(userID uint32, rows ...string) useCases.ContentCaller {
	return useCases.ContentCaller{UserID: userID, Grants: unlockedGrantSet(rows...)}
}

func contentAccess(getUser *useCases.GetUserUseCase) func(http.Handler) http.Handler {
	adminGrants := role.BuiltInRoles()[1].GrantSet()
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			r = access.WithCurrentUser(r)
			if userID, ok := claims.UserId(r); ok {
				account, err := access.LoadUser(getUser, r, userID)
				version, hasVersion := claims.TokenVersion(r)
				if err == nil && account.IsVerified && (!hasVersion || version == account.TokenVersion) {
					r = r.WithContext(access.WithCaller(r.Context(), access.Caller{UserID: userID, Grants: adminGrants}))
				}
			}
			next.ServeHTTP(w, r)
		})
	}
}