package automation

import (
	"github.com/nexuscrm/shared/pkg/constants"
	"github.com/nexuscrm/shared/pkg/models"
)

// newSystemAutomationUser builds the identity for scheduled and record-triggered
// automation that runs without a real end-user (Salesforce "system context").
//
// Security is enforced via constants.WithSecurityContext(ctx, SystemContext, ...)
// on the context — that bypasses process-field, CRUD/FLS, and RLS checks at the
// persistence layer. The user session itself carries only an identity (for audit /
// OwnerId attribution), NOT elevated permissions, so the permission-service layer
// can still distinguish automation from a real admin if needed.
//
// ProfileName is stamped as "Automated Process" per Salesforce convention: the
// user that runs scheduled-trigger flows appears as the "Automated Process" user
// with profile name "Automated Process" in SF audit / formula context. This means
// scheduled-flow $Profile.Name resolves to "Automated Process" rather than "".
func newSystemAutomationUser() *models.UserSession {
	email := constants.SystemUserEmail

	return &models.UserSession{
		ID:          constants.SystemUserID,
		Name:        constants.SystemSchedulerUserName,
		Email:       &email,
		ProfileName: "Automated Process",
	}
}