package permissions

import (
	"context"
	"strings"
	"testing"

	"github.com/nexuscrm/backend/internal/domain/ports"
	"github.com/nexuscrm/shared/pkg/constants"
	"github.com/nexuscrm/shared/pkg/models"
)

// MockPermissionService provides test helpers for PermissionService
// Note: These tests don't require a database connection since they test
// the logic flow (SuperUser bypass, nil user handling, etc.)

func TestCheckObjectPermissionWithUser_NilUser(t *testing.T) {
	// Create a minimal permission service (db and metadata will be nil)
	ps := &PermissionService{}

	// Nil user should return false
	result := ps.CheckObjectPermissionWithUser(context.Background(), "Account", constants.PermRead, nil)
	if result {
		t.Error("Expected false for nil user, got true")
	}
}

func TestCheckObjectPermissionWithUser_SuperUser(t *testing.T) {
	// Create a minimal permission service
	ps := &PermissionService{}

	// Super user (system_admin) should bypass all checks
	user := &models.UserSession{
		ID:        "test-user-id",
		Name:      "Test Admin",
		ProfileID: constants.ProfileSystemAdmin,
	}

	operations := []string{constants.PermRead, constants.PermCreate, constants.PermEdit, constants.PermDelete}
	for _, op := range operations {
		result := ps.CheckObjectPermissionWithUser(context.Background(), "Account", op, user)
		if !result {
			t.Errorf("Expected true for SuperUser %s operation, got false", op)
		}
	}
}

func TestCheckFieldEditabilityWithUser_SystemField(t *testing.T) {
	ps := &PermissionService{}

	user := &models.UserSession{
		ID:        "test-user-id",
		Name:      "Test User",
		ProfileID: constants.ProfileSystemAdmin,
	}

	// System fields should never be editable, even for super users
	systemFields := []string{
		constants.FieldID,
		constants.FieldCreatedDate,
		constants.FieldCreatedByID,
		constants.FieldLastModifiedDate,
		constants.FieldLastModifiedByID,
		constants.FieldIsDeleted,
	}

	for _, field := range systemFields {
		result := ps.CheckFieldEditabilityWithUser(context.Background(), "Account", field, user)
		if result {
			t.Errorf("Expected system field %s to be non-editable, got editable", field)
		}
	}
}

func TestCheckFieldVisibilityWithUser_NilUser(t *testing.T) {
	ps := &PermissionService{}

	// Nil user should return false
	result := ps.CheckFieldVisibilityWithUser(context.Background(), "Account", constants.FieldName, nil)
	if result {
		t.Error("Expected false for nil user, got true")
	}
}

func TestCheckFieldVisibilityWithUser_SuperUser(t *testing.T) {
	ps := &PermissionService{}

	user := &models.UserSession{
		ID:        "test-user-id",
		Name:      "Test Admin",
		ProfileID: constants.ProfileSystemAdmin,
	}

	// Super user should see all fields
	result := ps.CheckFieldVisibilityWithUser(context.Background(), "Account", constants.FieldName, user)
	if !result {
		t.Error("Expected true for SuperUser field visibility, got false")
	}
}

func TestCheckPermissionOrErrorWithUser_NilUser(t *testing.T) {
	ps := &PermissionService{}

	err := ps.CheckPermissionOrErrorWithUser(context.Background(), "Account", constants.PermRead, nil)
	if err == nil {
		t.Error("Expected error for nil user, got nil")
	}
}

func TestCheckPermissionOrErrorWithUser_SuperUser(t *testing.T) {
	ps := &PermissionService{}

	user := &models.UserSession{
		ID:        "test-user-id",
		Name:      "Test Admin",
		ProfileID: constants.ProfileSystemAdmin,
	}

	err := ps.CheckPermissionOrErrorWithUser(context.Background(), "Account", constants.PermRead, user)
	if err != nil {
		t.Errorf("Expected no error for SuperUser, got: %v", err)
	}
}
func TestGetEffectiveSchema_NilSchema(t *testing.T) {
	ps := &PermissionService{}
	result := ps.GetEffectiveSchema(context.Background(), nil, nil)
	if result != nil {
		t.Error("Expected nil result for nil schema")
	}
}

func TestGetEffectiveSchema_SuperUser(t *testing.T) {
	ps := &PermissionService{}
	user := &models.UserSession{
		ID:        "admin",
		ProfileID: constants.ProfileSystemAdmin,
	}
	schema := &models.ObjectMetadata{
		APIName: "Account",
		Fields: []models.FieldMetadata{
			{APIName: constants.FieldName},
			{APIName: "Secret"},
		},
	}

	result := ps.GetEffectiveSchema(context.Background(), schema, user)
	if len(result.Fields) != 2 {
		t.Errorf("Expected SuperUser to see all 2 fields, got %d", len(result.Fields))
	}
}

func TestGetEffectiveSchema_NilUser(t *testing.T) {
	ps := &PermissionService{}
	schema := &models.ObjectMetadata{
		APIName: "Account",
		Fields: []models.FieldMetadata{
			{APIName: constants.FieldName},
			{APIName: "Secret"},
		},
	}

	// Nil user -> CheckFieldVisibility returns false -> Filtering happens
	result := ps.GetEffectiveSchema(context.Background(), schema, nil)
	if len(result.Fields) != 0 {
		t.Errorf("Expected nil user to see 0 fields, got %d", len(result.Fields))
	}
}

func TestCheckRecordAccess_Owner(t *testing.T) {
	// Setup
	ps := &PermissionService{}
	user := &models.UserSession{ID: "user1", ProfileID: "profile1"}

	// Record owned by user
	record := models.SObject{
		constants.FieldID:      "rec1",
		constants.FieldOwnerID: "user1",
	}

	// Expect IsUserInGroup to NOT be called for owner check (optimization)
	// The implementation checks owner first: if ownerIDStr == user.ID { return true }

	if !ps.CheckRecordAccess(context.Background(), nil, record, constants.PermEdit, user) {
		t.Errorf("Expected owner to have access")
	}
}

// TestCheckRecordAccess_NonOwner removed as it requires DB mocking (PermissionService uses concrete repos)
// Covered by sharing_rules_test.go integration tests.

func TestCheckRecordAccess_SuperUser(t *testing.T) {
	ps := &PermissionService{}
	// System Admin Profile
	user := &models.UserSession{ID: "user1", ProfileID: constants.ProfileSystemAdmin}

	record := models.SObject{
		constants.FieldID:      "rec1",
		constants.FieldOwnerID: "other_user",
	}

	// Should pass without DB lookup due to SuperUser check returning early
	if !ps.CheckRecordAccess(context.Background(), nil, record, constants.PermEdit, user) {
		t.Errorf("Expected SuperUser to have access")
	}
}

func TestCheckRecordAccess_NoOwnerField(t *testing.T) {
	ps := &PermissionService{}
	user := &models.UserSession{ID: "user1", ProfileID: "profile1"}

	// Record with no owner field
	record := models.SObject{
		constants.FieldID: "rec1",
	}

	// Should fail safely
	// No owner field -> hasOwner = false. Skips Group/Owner checks.
	// Skips Hierarchy.
	// Skips Sharing Rules (nil schema).
	// Skips Manual Share (nil schema).

	if ps.CheckRecordAccess(context.Background(), nil, record, constants.PermEdit, user) {
		t.Errorf("Expected no access when no owner field present")
	}
}

func TestCheckRecordAccess_PointerOwner(t *testing.T) {
	ps := &PermissionService{}
	user := &models.UserSession{ID: "user1", ProfileID: "profile1"}

	ownerID := "user1"
	record := models.SObject{
		constants.FieldID:      "rec1",
		constants.FieldOwnerID: &ownerID,
	}

	if !ps.CheckRecordAccess(context.Background(), nil, record, constants.PermEdit, user) {
		t.Errorf("Expected owner (pointer) to have access")
	}
}

// Test validatePermissionDependencies function for validation logic
func TestValidatePermissionDependencies_ModifyAllRequiresDependents(t *testing.T) {
	// Test case: ModifyAllRecords=true but dependent permissions are false - should fail
	input := models.ObjectPermissions{
		SobjectType:                 "Account",
		PermissionsModifyAllRecords: true,
		PermissionsRead:             false,
		PermissionsCreate:           false,
		PermissionsEdit:             false,
		PermissionsDelete:           false,
		PermissionsViewAllRecords:   false,
	}

	err := validatePermissionDependencies(input)
	if err == nil {
		t.Error("Expected validation error when ModifyAllRecords is true but dependent permissions are false")
	}
	if err != nil && !strings.Contains(err.Error(), "FIELD_INTEGRITY_EXCEPTION") {
		t.Errorf("Expected FIELD_INTEGRITY_EXCEPTION error, got: %v", err)
	}
}

func TestValidatePermissionDependencies_ViewAllRequiresRead(t *testing.T) {
	// Test case: ViewAllRecords=true but Read=false - should fail
	input := models.ObjectPermissions{
		SobjectType:               "Account",
		PermissionsModifyAllRecords: false,
		PermissionsRead:           false,
		PermissionsViewAllRecords:   true,
	}

	err := validatePermissionDependencies(input)
	if err == nil {
		t.Error("Expected validation error when ViewAllRecords is true but Read is false")
	}
	if err != nil && !strings.Contains(err.Error(), "FIELD_INTEGRITY_EXCEPTION") {
		t.Errorf("Expected FIELD_INTEGRITY_EXCEPTION error, got: %v", err)
	}
}

func TestValidatePermissionDependencies_PartialFailure(t *testing.T) {
	// Test case: ModifyAllRecords=true but only some dependent permissions are true - should fail
	input := models.ObjectPermissions{
		SobjectType:                 "Account",
		PermissionsModifyAllRecords: true,
		PermissionsRead:             true,  // Provided
		PermissionsCreate:           true,  // Provided
		PermissionsEdit:             false, // Missing
		PermissionsDelete:           false, // Missing
		PermissionsViewAllRecords:   false, // Missing
	}

	err := validatePermissionDependencies(input)
	if err == nil {
		t.Error("Expected validation error when ModifyAllRecords is true but some dependent permissions are false")
	}
	if err != nil && !strings.Contains(err.Error(), "FIELD_INTEGRITY_EXCEPTION") {
		t.Errorf("Expected FIELD_INTEGRITY_EXCEPTION error, got: %v", err)
	}

	// Test case: ModifyAllRecords=true but only Read and Create are true - should fail
	input2 := models.ObjectPermissions{
		SobjectType:                 "Account",
		PermissionsModifyAllRecords: true,
		PermissionsRead:             true,  // Provided
		PermissionsCreate:           true,  // Provided
		PermissionsEdit:             false, // Missing
		PermissionsDelete:           false, // Missing
		PermissionsViewAllRecords:   false, // Missing
	}

	err = validatePermissionDependencies(input2)
	if err == nil {
		t.Error("Expected validation error when ModifyAllRecords is true but some dependent permissions are false")
	}

	// Test case: ViewAllRecords=true but only Read is true - this should actually pass since Read is only dependency of ViewAll
	input3 := models.ObjectPermissions{
		SobjectType:               "Account",
		PermissionsModifyAllRecords: false,
		PermissionsRead:           true,  // Provided
		PermissionsCreate:         false,
		PermissionsEdit:           false,
		PermissionsDelete:         false,
		PermissionsViewAllRecords:   true,  // This should be fine if Read is true
	}

	err = validatePermissionDependencies(input3)
	if err != nil {
		t.Errorf("Unexpected validation error when ViewAll and Read are both true: %v", err)
	}

	// Test case: ViewAllRecords=true but Read is false - should fail
	input4 := models.ObjectPermissions{
		SobjectType:               "Account",
		PermissionsModifyAllRecords: false,
		PermissionsRead:           false, // Missing dependency
		PermissionsCreate:         false,
		PermissionsEdit:           false,
		PermissionsDelete:         false,
		PermissionsViewAllRecords:   true,  // Should fail without Read
	}

	err = validatePermissionDependencies(input4)
	if err == nil {
		t.Error("Expected validation error when ViewAllRecords is true but Read is false")
	}
}

func TestBuildPermissionDescription_FallbackBranch(t *testing.T) {
	// Test case: Neither ModifyAllRecords nor ViewAllRecords is true - should return fallback
	input := models.ObjectPermissions{
		SobjectType:                 "Account",
		PermissionsModifyAllRecords: false,
		PermissionsRead:             false,
		PermissionsCreate:           true,  // Only Create is true
		PermissionsEdit:             false,
		PermissionsDelete:           false,
		PermissionsViewAllRecords:   false,
	}

	description := buildPermissionDescription(input)
	expected := "Permission for Account"
	if description != expected {
		t.Errorf("Expected '%s', got '%s'", expected, description)
	}

	// Test case: ModifyAllRecords=true - should return Modify All description
	input2 := models.ObjectPermissions{
		SobjectType:                 "Opportunity",
		PermissionsModifyAllRecords: true,
		PermissionsRead:             false,
		PermissionsCreate:           false,
		PermissionsEdit:             false,
		PermissionsDelete:           false,
		PermissionsViewAllRecords:   false,
	}

	description2 := buildPermissionDescription(input2)
	expected2 := "Modify All Opportunity"
	if description2 != expected2 {
		t.Errorf("Expected '%s', got '%s'", expected2, description2)
	}

	// Test case: ViewAllRecords=true - should return View All description
	input3 := models.ObjectPermissions{
		SobjectType:                 "Contact",
		PermissionsModifyAllRecords: false,
		PermissionsRead:             false,
		PermissionsCreate:           false,
		PermissionsEdit:             false,
		PermissionsDelete:           false,
		PermissionsViewAllRecords:   true,
	}

	description3 := buildPermissionDescription(input3)
	expected3 := "View All Contact"
	if description3 != expected3 {
		t.Errorf("Expected '%s', got '%s'", expected3, description3)
	}
}

// Test integration of permission validation with service methods
func TestUpdateObjectPermission_ValidationLogic(t *testing.T) {
	// Create a mock permission repository
	mockRepo := &mockPermissionRepo{}

	ps := &PermissionService{
		repo: mockRepo,
	}

	ctx := context.Background()

	// Test valid state: all dependencies satisfied - should succeed
	validPerm := models.ObjectPermissions{
		ID:                          "test-id",
		ParentID:                    "parent-id",
		SobjectType:                 "Account",
		PermissionsModifyAllRecords: true,
		PermissionsRead:             true,
		PermissionsCreate:           true,
		PermissionsEdit:             true,
		PermissionsDelete:           true,
		PermissionsViewAllRecords:   true,
	}

	err := ps.UpdateObjectPermission(ctx, validPerm)
	if err != nil {
		t.Fatalf("Unexpected error with valid permission state: %v", err)
	}

	// Verify the permission was saved
	if mockRepo.lastUpsertedPermission.PermissionsModifyAllRecords != true {
		t.Error("Expected PermissionsModifyAllRecords to be true")
	}

	// Test invalid state: missing dependencies - should fail
	invalidPerm := models.ObjectPermissions{
		ID:                          "test-id2",
		ParentID:                    "parent-id2",
		SobjectType:                 "Account",
		PermissionsModifyAllRecords: true,
		PermissionsRead:             false, // Missing dependency
		PermissionsCreate:           false, // Missing dependency
		PermissionsEdit:             false, // Missing dependency
		PermissionsDelete:           false, // Missing dependency
		PermissionsViewAllRecords:   false, // Missing dependency
	}

	err = ps.UpdateObjectPermission(ctx, invalidPerm)
	if err == nil {
		t.Fatalf("Expected validation error with invalid permission state")
	}
}

func TestUpdateObjectPermissionTx_ValidationLogic(t *testing.T) {
	// Create a mock permission repository
	mockRepo := &mockPermissionRepo{}

	ps := &PermissionService{
		repo: mockRepo,
	}

	ctx := context.Background()

	// Test valid state: ViewAll + Read = valid
	validPerm := models.ObjectPermissions{
		ID:                          "test-id",
		ParentID:                    "parent-id",
		SobjectType:                 "Account",
		PermissionsModifyAllRecords: false,
		PermissionsRead:             true,
		PermissionsViewAllRecords:   true,
		PermissionsCreate:           true,
		PermissionsEdit:             true,
		PermissionsDelete:           true,
	}

	err := ps.UpdateObjectPermissionTx(ctx, validPerm)
	if err != nil {
		t.Fatalf("Unexpected error with valid permission state: %v", err)
	}

	// Verify the permission was saved
	if mockRepo.lastUpsertedPermission.PermissionsViewAllRecords != true {
		t.Error("Expected PermissionsViewAllRecords to remain true")
	}

	// Test invalid state: ViewAll without Read = invalid
	invalidPerm := models.ObjectPermissions{
		ID:                          "test-id2",
		ParentID:                    "parent-id2",
		SobjectType:                 "Account",
		PermissionsModifyAllRecords: false,
		PermissionsRead:             false,
		PermissionsViewAllRecords:   true, // Should fail without Read
		PermissionsCreate:           false,
		PermissionsEdit:             false,
		PermissionsDelete:           false,
	}

	err = ps.UpdateObjectPermissionTx(ctx, invalidPerm)
	if err == nil {
		t.Fatalf("Expected validation error when ViewAll is set without Read")
	}
}

func TestUpdatePermissionSetObjectPermission_ValidationLogic(t *testing.T) {
	// Create a mock permission repository
	mockRepo := &mockPermissionRepo{}

	ps := &PermissionService{
		repo: mockRepo,
	}

	ctx := context.Background()

	// Test valid state: all dependencies satisfied - should succeed
	validPerm := models.ObjectPermissions{
		ID:                          "test-id",
		ParentID:                    "permset-id",
		SobjectType:                 "Account",
		PermissionsModifyAllRecords: true,
		PermissionsRead:             true,
		PermissionsCreate:           true,
		PermissionsEdit:             true,
		PermissionsDelete:           true,
		PermissionsViewAllRecords:   true,
	}

	err := ps.UpdatePermissionSetObjectPermission(ctx, validPerm)
	if err != nil {
		t.Fatalf("Unexpected error with valid permission state: %v", err)
	}

	// Verify the permission was saved
	if mockRepo.lastUpsertedPermission.PermissionsModifyAllRecords != true {
		t.Error("Expected PermissionsModifyAllRecords to be true")
	}

	// Test invalid state: missing dependencies - should fail
	invalidPerm := models.ObjectPermissions{
		ID:                          "test-id2",
		ParentID:                    "permset-id2",
		SobjectType:                 "Account",
		PermissionsModifyAllRecords: true,
		PermissionsRead:             false, // Missing dependency
		PermissionsCreate:           false, // Missing dependency
		PermissionsEdit:             false, // Missing dependency
		PermissionsDelete:           false, // Missing dependency
		PermissionsViewAllRecords:   false, // Missing dependency
	}

	err = ps.UpdatePermissionSetObjectPermission(ctx, invalidPerm)
	if err == nil {
		t.Fatalf("Expected validation error with invalid permission state")
	}
}

// MockPermissionRepo is a mock implementation of PermissionRepository for testing
type mockPermissionRepo struct {
	lastUpsertedPermission models.ObjectPermissions
}

func (m *mockPermissionRepo) UpsertObjectPermission(ctx context.Context, perm models.ObjectPermissions) error {
	m.lastUpsertedPermission = perm
	return nil
}

// Implement other required methods with minimal implementations
func (m *mockPermissionRepo) LoadObjectPermission(ctx context.Context, profileID, objectAPIName string) (*models.ObjectPermissions, error) {
	return nil, nil
}
func (m *mockPermissionRepo) LoadFieldPermission(ctx context.Context, profileID, objectAPIName, fieldAPIName string) (*models.FieldPermissions, error) {
	return nil, nil
}
func (m *mockPermissionRepo) LoadEffectiveObjectPermission(ctx context.Context, user *models.UserSession, objectAPIName string) (*models.ObjectPermissions, error) {
	return nil, nil
}
func (m *mockPermissionRepo) LoadEffectiveFieldPermission(ctx context.Context, user *models.UserSession, objectAPIName, fieldAPIName string) (*models.FieldPermissions, error) {
	return nil, nil
}
func (m *mockPermissionRepo) ListObjectPermissions(ctx context.Context, profileID string) ([]models.ObjectPermissions, error) {
	return nil, nil
}
func (m *mockPermissionRepo) ListFieldPermissions(ctx context.Context, profileID string) ([]models.FieldPermissions, error) {
	return nil, nil
}
func (m *mockPermissionRepo) UpsertFieldPermission(ctx context.Context, perm models.FieldPermissions) error {
	return nil
}
func (m *mockPermissionRepo) CountObjectPermissionsByProfile(ctx context.Context, profileID string) (int, error) {
	return 0, nil
}
func (m *mockPermissionRepo) BatchUpsertObjectPermissions(ctx context.Context, perms []models.ObjectPermissions) error {
	return nil
}
func (m *mockPermissionRepo) BatchUpsertFieldPermissions(ctx context.Context, perms []models.FieldPermissions) error {
	return nil
}
func (m *mockPermissionRepo) DeleteFieldPermissionsForFields(ctx context.Context, objectAPIName string, fieldAPINames []string) error {
	return nil
}
func (m *mockPermissionRepo) CleanupDirectProfilePermissions(ctx context.Context, profileIDs []string) error {
	return nil
}
func (m *mockPermissionRepo) BulkEnsureProfilePermissionSets(ctx context.Context, profiles []struct{ ID, Name string }) (map[string]string, error) {
	return nil, nil
}
func (m *mockPermissionRepo) BulkCountObjectPermissionsByProfiles(ctx context.Context, profileIDs []string) (map[string]int, error) {
	return nil, nil
}
func (m *mockPermissionRepo) BulkCountFieldPermissionsByProfiles(ctx context.Context, profileIDs []string) (map[string]int, error) {
	return nil, nil
}
func (m *mockPermissionRepo) BulkCountObjectPermissionsByProfilesAndTypes(ctx context.Context, profileIDs []string, objectAPINames []string) (map[string]int, error) {
	return nil, nil
}
func (m *mockPermissionRepo) BulkCountFieldPermissionsByProfilesAndTypes(ctx context.Context, profileIDs []string, objectAPINames []string) (map[string]int, error) {
	return nil, nil
}
func (m *mockPermissionRepo) EnsureProfilePermissionSet(ctx context.Context, profileID, profileName string) (string, error) {
	return "", nil
}
func (m *mockPermissionRepo) CleanupProfilePermissionSet(ctx context.Context, profileID string) error {
	return nil
}
func (m *mockPermissionRepo) UpsertObjectPermissionTx(ctx context.Context, tx interface{}, perm models.ObjectPermissions) error {
	return nil
}
func (m *mockPermissionRepo) UpsertFieldPermissionTx(ctx context.Context, tx interface{}, perm models.FieldPermissions) error {
	return nil
}
func (m *mockPermissionRepo) ListPermissionSetObjectPermissions(ctx context.Context, permissionSetID string) ([]models.ObjectPermissions, error) {
	return nil, nil
}
func (m *mockPermissionRepo) ListPermissionSetFieldPermissions(ctx context.Context, permissionSetID string) ([]models.FieldPermissions, error) {
	return nil, nil
}
func (m *mockPermissionRepo) GetRole(ctx context.Context, id string) (*models.UserRole, error) {
	return nil, nil
}
func (m *mockPermissionRepo) GetAllRoles(ctx context.Context) ([]*models.UserRole, error) {
	return nil, nil
}
func (m *mockPermissionRepo) CreateRole(ctx context.Context, name, description string, parentRoleID *string) (string, error) {
	return "", nil
}
func (m *mockPermissionRepo) UpdateRole(ctx context.Context, id string, name, description string, parentRoleID *string) error {
	return nil
}
func (m *mockPermissionRepo) DeleteRole(ctx context.Context, id string) error {
	return nil
}
func (m *mockPermissionRepo) GetAllProfiles(ctx context.Context) ([]*models.Profile, error) {
	return nil, nil
}
func (m *mockPermissionRepo) GetUserProfileID(ctx context.Context, userID string) (string, error) {
	return "", nil
}
func (m *mockPermissionRepo) GetEffectiveSystemPermissions(ctx context.Context, userID, profileID string) (map[string]bool, error) {
	return nil, nil
}
func (m *mockPermissionRepo) GetEffectiveCustomPermissions(ctx context.Context, userID, profileID string) (map[string]bool, error) {
	return nil, nil
}
func (m *mockPermissionRepo) SetSystemPermission(ctx context.Context, permSetID, apiName string, enabled bool) error {
	return nil
}
func (m *mockPermissionRepo) LockPermissionSet(ctx context.Context, permSetID string) (bool, error) {
	return true, nil
}
func (m *mockPermissionRepo) GetPermissionSetGrants(ctx context.Context, permSetID string) (map[string]bool, error) {
	return nil, nil
}
func (m *mockPermissionRepo) GetPermissionSetGrantsMany(ctx context.Context, permSetIDs []string) (map[string]map[string]bool, error) {
	return nil, nil
}
func (m *mockPermissionRepo) ListEffectiveObjectPermissionsForUser(ctx context.Context, userID, profileID string) ([]models.ObjectPermissions, error) {
	return nil, nil
}
func (m *mockPermissionRepo) ListEffectiveFieldPermissionsForUser(ctx context.Context, userID, profileID string) ([]models.FieldPermissions, error) {
	return nil, nil
}

// Additional methods required by PermissionRepository interface
func (m *mockPermissionRepo) CreatePermissionSet(ctx context.Context, name, label, description string) (string, error) {
	return "", nil
}

func (m *mockPermissionRepo) UpdatePermissionSet(ctx context.Context, id, name, label, description string) error {
	return nil
}

func (m *mockPermissionRepo) DeletePermissionSet(ctx context.Context, id string) error {
	return nil
}

func (m *mockPermissionRepo) IsUserInGroup(ctx context.Context, groupID, userID string) (bool, error) {
	return false, nil
}

func (m *mockPermissionRepo) GetManualShareAccessLevels(ctx context.Context, objectAPIName, recordID, userID string) ([]string, error) {
	return nil, nil
}

func (m *mockPermissionRepo) GetTeamMemberAccessLevel(ctx context.Context, objectAPIName, recordID, userID string) (*string, error) {
	return nil, nil
}

func (m *mockPermissionRepo) GetRecordOwnerID(ctx context.Context, tableName, recordID string) (string, error) {
	return "", nil
}

func (m *mockPermissionRepo) GetRecordByID(ctx context.Context, tableName, recordID string) (models.SObject, error) {
	return nil, nil
}

func (m *mockPermissionRepo) GetPendingApprovalLockInfo(ctx context.Context, targetObjectID string) (string, string, error) {
	return "", "", nil
}

func (m *mockPermissionRepo) HasPendingApprovalWorkitemForUser(ctx context.Context, processInstanceID, userID string) (bool, error) {
	return false, nil
}

func (m *mockPermissionRepo) GetUserGroupIDs(ctx context.Context, userID string) ([]string, error) {
	return nil, nil
}

func (m *mockPermissionRepo) GetManualShareRecordIDs(ctx context.Context, objectAPIName, userID string) ([]string, error) {
	return nil, nil
}

func (m *mockPermissionRepo) GetTeamMemberRecordIDs(ctx context.Context, objectAPIName, userID string) ([]string, error) {
	return nil, nil
}

func (m *mockPermissionRepo) ListSystemPermissions(ctx context.Context) ([]models.SystemPermission, error) {
	return nil, nil
}

func (m *mockPermissionRepo) ListCustomPermissions(ctx context.Context) ([]models.SystemCustomPermission, error) {
	return nil, nil
}

func (m *mockPermissionRepo) GetCustomPermission(ctx context.Context, id string) (*models.SystemCustomPermission, error) {
	return nil, nil
}

func (m *mockPermissionRepo) CreateCustomPermission(ctx context.Context, perm *models.SystemCustomPermission) error {
	return nil
}

func (m *mockPermissionRepo) UpdateCustomPermission(ctx context.Context, perm *models.SystemCustomPermission) error {
	return nil
}

func (m *mockPermissionRepo) DeleteCustomPermission(ctx context.Context, id string) error {
	return nil
}

func (m *mockPermissionRepo) ListPermissionSetGroups(ctx context.Context) ([]models.PermissionSetGroup, error) {
	return nil, nil
}

func (m *mockPermissionRepo) GetPermissionSetGroupByID(ctx context.Context, id string) (*models.PermissionSetGroup, error) {
	return nil, nil
}

func (m *mockPermissionRepo) GetPermissionSetGroupComponents(ctx context.Context, groupID string) ([]ports.PermissionSetRef, error) {
	return nil, nil
}

func (m *mockPermissionRepo) CreatePermissionSetGroup(ctx context.Context, group *models.PermissionSetGroup, permSetIDs []string) error {
	return nil
}

func (m *mockPermissionRepo) UpdatePermissionSetGroup(ctx context.Context, group *models.PermissionSetGroup, permSetIDs []string) error {
	return nil
}

func (m *mockPermissionRepo) DeletePermissionSetGroup(ctx context.Context, id string) error {
	return nil
}