package permissions

import (
	"context"

	"github.com/nexuscrm/backend/pkg/errors"
	"github.com/nexuscrm/shared/pkg/models"
)

// --- Permission Set Permissions ---

// GetPermissionSetObjectPermissions retrieves all object permissions for a permission set
func (ps *PermissionService) GetPermissionSetObjectPermissions(ctx context.Context, permissionSetID string) ([]models.ObjectPermissions, error) {
	return ps.repo.ListPermissionSetObjectPermissions(ctx, permissionSetID)
}

// GetPermissionSetFieldPermissions retrieves all field permissions for a permission set
func (ps *PermissionService) GetPermissionSetFieldPermissions(ctx context.Context, permissionSetID string) ([]models.FieldPermissions, error) {
	return ps.repo.ListPermissionSetFieldPermissions(ctx, permissionSetID)
}

// UpdatePermissionSetObjectPermission creates or updates an object permission for a permission set
func (ps *PermissionService) UpdatePermissionSetObjectPermission(ctx context.Context, perm models.ObjectPermissions) error {
	if perm.ParentID == "" {
		return errors.NewValidationError("permission_set_id", "permission_set_id is required")
	}

	// Validate permission dependencies before persisting
	if err := validatePermissionDependencies(perm); err != nil {
		return errors.NewValidationError("", err.Error())
	}

	return ps.repo.UpsertObjectPermission(ctx, perm)
}

// UpdatePermissionSetFieldPermission creates or updates a field permission for a permission set
func (ps *PermissionService) UpdatePermissionSetFieldPermission(ctx context.Context, perm models.FieldPermissions) error {
	if perm.ParentID == "" {
		return errors.NewValidationError("permission_set_id", "permission_set_id is required")
	}
	return ps.repo.UpsertFieldPermission(ctx, perm)
}

// --- Effective Permissions (Admin View) ---

// GetEffectiveObjectPermissions returns the merged object permissions for a specific user
func (ps *PermissionService) GetEffectiveObjectPermissions(ctx context.Context, userID string) ([]models.ObjectPermissions, error) {
	profileID, err := ps.repo.GetUserProfileID(ctx, userID)
	if err != nil {
		return nil, errors.NewInternalError("failed to get user profile", err)
	}

	return ps.repo.ListEffectiveObjectPermissionsForUser(ctx, userID, profileID)
}

// GetEffectiveFieldPermissions returns the merged field permissions for a specific user
func (ps *PermissionService) GetEffectiveFieldPermissions(ctx context.Context, userID string) ([]models.FieldPermissions, error) {
	profileID, err := ps.repo.GetUserProfileID(ctx, userID)
	if err != nil {
		return nil, errors.NewInternalError("failed to get user profile", err)
	}

	return ps.repo.ListEffectiveFieldPermissionsForUser(ctx, userID, profileID)
}

// --- Permission Set Management ---

// CreatePermissionSet creates a new permission set
func (ps *PermissionService) CreatePermissionSet(ctx context.Context, name, label, description string) (string, error) {
	return ps.repo.CreatePermissionSet(ctx, name, label, description)
}

// UpdatePermissionSet updates a permission set
func (ps *PermissionService) UpdatePermissionSet(ctx context.Context, id string, name, label, description string) error {
	return ps.repo.UpdatePermissionSet(ctx, id, name, label, description)
}

// DeletePermissionSet deletes a permission set
func (ps *PermissionService) DeletePermissionSet(ctx context.Context, id string) error {
	return ps.repo.DeletePermissionSet(ctx, id)
}