import { getDatabase } from '$lib/server/database';
import type { AuthUser } from './session';
import { error } from '@sveltejs/kit';

export async function getPermissions(user: AuthUser | null): Promise<string[]> {
	if (!user) return [];
	if (user.role === 'admin') return ['*'];
	const database = await getDatabase();
	const rows = await (await database.prepare(`
		SELECT permissions.name FROM permissions
		JOIN role_permissions ON role_permissions.permission_id=permissions.id
		JOIN user_roles ON user_roles.role_id=role_permissions.role_id
		WHERE user_roles.user_id=?
		UNION
		SELECT permissions.name FROM permissions
		JOIN user_permissions ON user_permissions.permission_id=permissions.id
		WHERE user_permissions.user_id=?
	`)).all(user.id, user.id);
	const permissions = rows.map((row) => String(row.name));
	return permissions.includes('system.admin') ? ['*'] : permissions;
}

export async function hasPermission(user: AuthUser | null, permission: string): Promise<boolean> {
	const permissions = await getPermissions(user);
	return permissions.includes('*') || permissions.includes(permission);
}

export async function requirePermission(user: AuthUser | null, permission: string): Promise<AuthUser> {
	if (!user) error(401, 'Sign in required');
	if (!(await hasPermission(user, permission))) error(403, 'ISAC permission required');
	return user;
}

export async function requireDataView(user: AuthUser | null): Promise<AuthUser> {
	if (!user) error(401, 'Sign in required');
	const permissions = await getPermissions(user);
	if (!permissions.includes('*') && !['data.view', 'data.manage', 'data.propose', 'data.approve'].some((permission) => permissions.includes(permission))) {
		error(403, 'ISAC data access required');
	}
	return user;
}

export function requireAdmin(user: AuthUser | null): asserts user is AuthUser {
	if (!user) error(401, 'Sign in required');
	if (user.role !== 'admin') error(403, 'Administrator permission required');
}