package runtimeapi

import (
	"context"
	"encoding/json"
	"errors"
	"sort"
	"strings"
	"sync"
	"sync/atomic"
	"time"

	"github.com/nexuscrm/metadata/catalogsnapshot"
	"github.com/nexuscrm/shared/pkg/contract"
	"github.com/nexuscrm/shared/pkg/models"
	"github.com/nexuscrm/shared/pkg/recordtypes"
	permissionsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/effectivepermissionsv1"
	"github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/permissionstatev1"
	recordsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/recordsv1"
	recordviewsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/recordviewv1"
	runtimev1 "github.com/pingcap-inc/nexuscrm-contract/wire-go/gen/runtime/v1"
	"github.com/pingcap-inc/nexuscrm-contract/wire-go/mapping"
	"github.com/prometheus/client_golang/prometheus"
	"github.com/rs/zerolog/log"
	"google.golang.org/protobuf/proto"
)

type EffectivePermissionEngine interface {
	EffectivePermissions(
		context.Context,
		*models.UserSession,
		string,
		permissionstatev1.Version,
	) (*contract.EffectivePermissionsResult, error)
}

type SelectedEffectivePermissionEngine interface {
	EffectivePermissionsSelected(
		context.Context,
		*models.UserSession,
		string,
		permissionsemantic.Selection,
		permissionstatev1.Version,
	) (*contract.EffectivePermissionsResult, error)
}

// readSelectedRecordAuthority reuses the sole exact-authority serving cache
// inside L0 and projects only the sections needed by one record workspace. It
// deliberately does not expose a reusable write token: mutations still admit
// and fence Permission State independently.
func (server *EffectivePermissionServer) readSelectedRecordAuthority(
	ctx context.Context,
	view *catalogsnapshot.RuntimeMetadataView,
	receipts recordsemantic.Receipts,
	_ TrustedCall,
	objectID string,
	selection recordviewsemantic.AuthoritySelection,
) (*recordviewsemantic.SelectedAuthority, *permissionsemantic.Response, error) {
	if server == nil || view == nil || !view.SupportsEffectivePermissionServing() {
		return nil, nil, &recordviewsemantic.Failure{Category: recordviewsemantic.FailureUnavailable}
	}
	permissionScope := RuntimeExecutionScope{
		view: view, capability: permissionsemantic.CapabilityName,
		receipts: receiptsForCapability(receipts, permissionsemantic.CapabilityName),
	}
	permissionCtx := context.WithValue(ctx, runtimeExecutionScopeContextKey{}, permissionScope)
	sections := make([]permissionsemantic.Section, 0, len(selection.Sections))
	for _, section := range selection.Sections {
		switch section {
		case recordviewsemantic.AuthoritySystemPermissions:
			sections = append(sections, permissionsemantic.SectionSystemPermissions)
		case recordviewsemantic.AuthorityCustomPermissions:
			sections = append(sections, permissionsemantic.SectionCustomPermissions)
		case recordviewsemantic.AuthorityObjectPermissions:
			sections = append(sections, permissionsemantic.SectionObjectPermissions)
		case recordviewsemantic.AuthorityFieldPermissions:
			sections = append(sections, permissionsemantic.SectionFieldPermissions)
		case recordviewsemantic.AuthorityRecordTypePermissions:
			sections = append(sections, permissionsemantic.SectionRecordTypePermissions)
		}
	}
	permissionRequest := permissionsemantic.Request{
		MinCatalogRevision: &receipts.CatalogRevision,
		Selection: &permissionsemantic.Selection{
			Sections: sections, ResourceTypes: []string{objectID},
		},
	}
	wireRequest, err := mapping.ToWireReadEffectivePermissionsRequest(permissionCtx, permissionRequest)
	if err != nil {
		return nil, nil, err
	}
	wireResponse, err := server.ReadEffectivePermissions(permissionCtx, wireRequest)
	if err != nil {
		return nil, nil, mapping.FromPlatformStatusError(err, permissionsemantic.CapabilityName)
	}
	response, err := mapping.FromWireReadEffectivePermissionsResponseForRequest(permissionRequest, wireResponse)
	if err != nil {
		return nil, nil, err
	}
	selected := &recordviewsemantic.SelectedAuthority{}
	for _, section := range selection.Sections {
		switch section {
		case recordviewsemantic.AuthoritySystemPermissions:
			selected.SystemPermissions = append(selected.SystemPermissions, response.SystemPermissions...)
		case recordviewsemantic.AuthorityCustomPermissions:
			selected.CustomPermissions = append(selected.CustomPermissions, response.CustomPermissions...)
		case recordviewsemantic.AuthorityObjectPermissions:
			for _, permission := range response.ObjectPermissions {
				if permission.ResourceType == objectID {
					selected.ObjectPermissions = append(selected.ObjectPermissions, permission)
				}
			}
		case recordviewsemantic.AuthorityFieldPermissions:
			for _, permission := range response.FieldPermissions {
				if permission.ResourceType == objectID {
					selected.FieldPermissions = append(selected.FieldPermissions, permission)
				}
			}
		case recordviewsemantic.AuthorityRecordTypePermissions:
			for _, permission := range response.RecordTypePermissions {
				if permission.ResourceType == objectID {
					selected.RecordTypePermissions = append(selected.RecordTypePermissions, permission)
				}
			}
		}
	}
	return selected, &response, nil
}

// effectivePermissionFloorValidator marks engines whose cold projection
// validates the admitted floor before reading authority. The serving cache is
// enabled only for that production-safe engine shape. Cache hits do not invoke
// it a second time: SecurityAdmission has already loaded the current durable
// floor for that same RPC, and the floor is part of the exact cache key.
type effectivePermissionFloorValidator interface {
	ValidatePermissionFloor(context.Context, permissionstatev1.Version) error
}

const effectivePermissionServingCacheCapacity = 64

type effectivePermissionServingCacheKey struct {
	viewerID           string
	sessionID          string
	targetPrincipalID  string
	permissionLineage  string
	permissionRevision uint64
	runtimeViewDigest  catalogsnapshot.Digest
	catalogRevision    uint64
	securityEpoch      uint64
	selection          string
}

// effectivePermissionServingCache is a bounded process-local reuse of one
// already projected wire response. It has no TTL and no singleflight: the exact
// authenticated session, Permission State, Catalog view and Security epoch
// identity determine reuse, and concurrent cold callers retain independent
// cancellation. The stored
// response is immutable after publication. Callers take the pointer under the
// lock and clone it after releasing the lock so one page burst cannot serialize
// thousands of permission rows behind this map mutex.
type effectivePermissionServingCache struct {
	mu      sync.RWMutex
	entries map[effectivePermissionServingCacheKey]effectivePermissionServingCacheEntry
	order   []effectivePermissionServingCacheKey
}

type effectivePermissionServingCacheEntry struct {
	response  *runtimev1.ReadEffectivePermissionsResponse
	wireBytes uint64
}

func normalizedEffectivePermissionSelection(
	view *catalogsnapshot.RuntimeMetadataView,
	selection *permissionsemantic.Selection,
) (*permissionsemantic.Selection, error) {
	if selection == nil {
		return nil, nil
	}
	if view == nil {
		return nil, &recordsemantic.Failure{Category: recordsemantic.FailureUnavailable}
	}
	canonical := make(map[string]string)
	for _, object := range view.Objects() {
		if object == nil {
			continue
		}
		canonical[permissionIdentityKey(object.APIName)] = object.APIName
	}
	result := &permissionsemantic.Selection{
		Sections:      append([]permissionsemantic.Section(nil), selection.Sections...),
		ResourceTypes: make([]string, 0, len(selection.ResourceTypes)),
	}
	for _, requested := range selection.ResourceTypes {
		resourceType, ok := canonical[permissionIdentityKey(requested)]
		if !ok {
			return nil, &permissionsemantic.Failure{
				Category:         permissionsemantic.FailureInvalidRequest,
				InvalidComponent: permissionsemantic.InvalidComponentOperation,
			}
		}
		result.ResourceTypes = append(result.ResourceTypes, resourceType)
	}
	sort.Strings(result.ResourceTypes)
	return result, nil
}

func effectivePermissionSelectionKey(selection *permissionsemantic.Selection) string {
	if selection == nil {
		return "complete"
	}
	var key strings.Builder
	for _, section := range selection.Sections {
		key.WriteString(string(section))
		key.WriteByte('\x00')
	}
	key.WriteByte('\xff')
	for _, resourceType := range selection.ResourceTypes {
		key.WriteString(resourceType)
		key.WriteByte('\x00')
	}
	return key.String()
}

type EffectivePermissionServer struct {
	runtimev1.UnimplementedEffectivePermissionServiceServer
	engine       EffectivePermissionEngine
	cacheEnabled bool
	cache        effectivePermissionServingCache
	metrics      effectivePermissionServingMetrics
}

type effectivePermissionServingMetrics struct {
	hits              atomic.Uint64
	misses            atomic.Uint64
	lookupNanoseconds atomic.Uint64
	cloneNanoseconds  atomic.Uint64
	responseBytes     atomic.Uint64

	requestsDesc      *prometheus.Desc
	durationDesc      *prometheus.Desc
	responseBytesDesc *prometheus.Desc
	entriesDesc       *prometheus.Desc
}

func newEffectivePermissionServingMetrics() effectivePermissionServingMetrics {
	return effectivePermissionServingMetrics{
		requestsDesc: prometheus.NewDesc(
			"nexuscrm_runtime_effective_permission_cache_requests_total",
			"Effective-permission serving cache lookups by bounded outcome.",
			[]string{"outcome"}, nil,
		),
		durationDesc: prometheus.NewDesc(
			"nexuscrm_runtime_effective_permission_cache_duration_seconds_total",
			"Cumulative effective-permission cache lookup and defensive-clone time.",
			[]string{"operation"}, nil,
		),
		responseBytesDesc: prometheus.NewDesc(
			"nexuscrm_runtime_effective_permission_response_bytes_total",
			"Cumulative protobuf bytes returned by the effective-permission service.",
			nil, nil,
		),
		entriesDesc: prometheus.NewDesc(
			"nexuscrm_runtime_effective_permission_cache_entries",
			"Current exact-authority effective-permission cache entries.",
			nil, nil,
		),
	}
}

func NewEffectivePermissionServer(
	engine EffectivePermissionEngine,
) (*EffectivePermissionServer, error) {
	if engine == nil {
		return nil, errors.New("runtime effective permissions: engine is required")
	}
	_, cacheEnabled := engine.(effectivePermissionFloorValidator)
	return &EffectivePermissionServer{
		engine:       engine,
		cacheEnabled: cacheEnabled,
		cache: effectivePermissionServingCache{
			entries: make(map[effectivePermissionServingCacheKey]effectivePermissionServingCacheEntry),
			order:   make([]effectivePermissionServingCacheKey, 0, effectivePermissionServingCacheCapacity),
		},
		metrics: newEffectivePermissionServingMetrics(),
	}, nil
}

func (server *EffectivePermissionServer) ReadEffectivePermissions(
	ctx context.Context,
	wireRequest *runtimev1.ReadEffectivePermissionsRequest,
) (*runtimev1.ReadEffectivePermissionsResponse, error) {
	request, err := mapping.FromWireReadEffectivePermissionsRequest(ctx, wireRequest)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(
			err, permissionsemantic.CapabilityName,
		)
	}
	scope, scopeOK := runtimeExecutionScopeFromContext(ctx)
	view, viewOK := RuntimeMetadataViewFromContext(ctx)
	trusted, trustedOK := trustedCallFromContext(ctx)
	if !scopeOK || !viewOK || !trustedOK {
		return nil, mapping.ToPlatformStatusError(
			&recordsemantic.Failure{
				Category: recordsemantic.FailureUnavailable,
			},
			permissionsemantic.CapabilityName,
		)
	}
	if err := requireCatalogRevision(
		request.MinCatalogRevision, scope.receipts.CatalogRevision,
	); err != nil {
		return nil, mapping.ToPlatformStatusError(
			err, permissionsemantic.CapabilityName,
		)
	}
	selection, err := normalizedEffectivePermissionSelection(view, request.Selection)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(
			err, permissionsemantic.CapabilityName,
		)
	}
	request.Selection = selection
	viewer := trusted.UserSession()
	cacheKey := effectivePermissionServingCacheKey{
		viewerID:           viewer.ID,
		sessionID:          trusted.sessionID,
		targetPrincipalID:  request.TargetPrincipalID,
		permissionLineage:  string(trusted.PermissionFloor().Lineage().Bytes()),
		permissionRevision: trusted.PermissionFloor().Revision(),
		runtimeViewDigest:  view.Digest(),
		catalogRevision:    scope.receipts.CatalogRevision,
		securityEpoch:      scope.receipts.SecurityEpoch,
		selection:          effectivePermissionSelectionKey(selection),
	}
	if server.cacheEnabled {
		lookupStarted := time.Now()
		cached, cachedBytes, ok := server.cache.get(cacheKey)
		server.metrics.lookupNanoseconds.Add(uint64(time.Since(lookupStarted)))
		if ok {
			// SecurityAdmission has just loaded the exact current Permission
			// State through the durable session authority and installed it in
			// TrustedCall. A changed floor therefore selects a different key and
			// misses. Loading the same singleton again here did not close a race
			// that the miss path closes; it only added another remote SQL read to
			// every cached response.
			server.metrics.hits.Add(1)
			cloneStarted := time.Now()
			response := proto.Clone(cached).(*runtimev1.ReadEffectivePermissionsResponse)
			server.metrics.cloneNanoseconds.Add(uint64(time.Since(cloneStarted)))
			server.metrics.responseBytes.Add(cachedBytes)
			if err := ctx.Err(); err != nil {
				return nil, mapping.ToPlatformStatusError(
					err, permissionsemantic.CapabilityName,
				)
			}
			return response, nil
		}
		server.metrics.misses.Add(1)
	}
	var projected *contract.EffectivePermissionsResult
	if selection == nil {
		projected, err = server.engine.EffectivePermissions(
			ctx,
			&viewer,
			request.TargetPrincipalID,
			trusted.PermissionFloor(),
		)
	} else {
		selectedEngine, ok := server.engine.(SelectedEffectivePermissionEngine)
		if !ok {
			return nil, mapping.ToPlatformStatusError(
				&recordsemantic.Failure{Category: recordsemantic.FailureUnavailable},
				permissionsemantic.CapabilityName,
			)
		}
		projected, err = selectedEngine.EffectivePermissionsSelected(
			ctx,
			&viewer,
			request.TargetPrincipalID,
			*selection,
			trusted.PermissionFloor(),
		)
	}
	if err != nil {
		return nil, mapping.ToPlatformStatusError(
			classifyEffectivePermissionError(ctx, err),
			permissionsemantic.CapabilityName,
		)
	}
	if err := ctx.Err(); err != nil {
		return nil, mapping.ToPlatformStatusError(
			err, permissionsemantic.CapabilityName,
		)
	}
	response, err := semanticEffectivePermissionsSelected(
		projected, view, scope.receipts, selection,
	)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(
			err, permissionsemantic.CapabilityName,
		)
	}
	if err := permissionsemantic.ValidateResponseForRequest(request, response); err != nil {
		var failure *permissionsemantic.Failure
		errors.As(err, &failure)
		category := permissionsemantic.FailureCategory("")
		limitKind := permissionsemantic.LimitKind("")
		var maximum uint64
		if failure != nil {
			category = failure.Category
			limitKind = failure.LimitKind
			maximum = failure.Maximum
		}
		semanticBytes := -1
		if encoded, marshalErr := json.Marshal(response); marshalErr == nil {
			semanticBytes = len(encoded)
		}
		log.Error().Err(err).
			Str("failure_category", string(category)).
			Str("limit_kind", string(limitKind)).
			Uint64("maximum", maximum).
			Int("semantic_bytes", semanticBytes).
			Int("system_permissions", len(response.SystemPermissions)).
			Int("custom_permissions", len(response.CustomPermissions)).
			Int("object_permissions", len(response.ObjectPermissions)).
			Int("field_permissions", len(response.FieldPermissions)).
			Int("application_permissions", len(response.ApplicationPermissions)).
			Int("navigation_permissions", len(response.NavigationPermissions)).
			Int("record_type_permissions", len(response.RecordTypePermissions)).
			Msg("runtime effective permission projection rejected")
		return nil, mapping.ToPlatformStatusError(
			err, permissionsemantic.CapabilityName,
		)
	}
	wireResponse, err := mapping.ToWireReadEffectivePermissionsResponseForRequest(request, response)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(
			err, permissionsemantic.CapabilityName,
		)
	}
	wireBytes := uint64(proto.Size(wireResponse))
	if server.cacheEnabled {
		server.cache.put(cacheKey, wireResponse, wireBytes)
	}
	server.metrics.responseBytes.Add(wireBytes)
	return wireResponse, nil
}

func (cache *effectivePermissionServingCache) get(
	key effectivePermissionServingCacheKey,
) (*runtimev1.ReadEffectivePermissionsResponse, uint64, bool) {
	if cache == nil {
		return nil, 0, false
	}
	cache.mu.RLock()
	defer cache.mu.RUnlock()
	entry, ok := cache.entries[key]
	if !ok || entry.response == nil {
		return nil, 0, false
	}
	return entry.response, entry.wireBytes, true
}

func (cache *effectivePermissionServingCache) put(
	key effectivePermissionServingCacheKey,
	response *runtimev1.ReadEffectivePermissionsResponse,
	wireBytes uint64,
) {
	if cache == nil || response == nil {
		return
	}
	stored := proto.Clone(response).(*runtimev1.ReadEffectivePermissionsResponse)
	cache.mu.Lock()
	defer cache.mu.Unlock()
	if _, exists := cache.entries[key]; exists {
		cache.entries[key] = effectivePermissionServingCacheEntry{
			response: stored, wireBytes: wireBytes,
		}
		return
	}
	if len(cache.order) >= effectivePermissionServingCacheCapacity {
		oldest := cache.order[0]
		cache.order = cache.order[1:]
		delete(cache.entries, oldest)
	}
	cache.order = append(cache.order, key)
	cache.entries[key] = effectivePermissionServingCacheEntry{
		response: stored, wireBytes: wireBytes,
	}
}

func (cache *effectivePermissionServingCache) len() int {
	if cache == nil {
		return 0
	}
	cache.mu.RLock()
	defer cache.mu.RUnlock()
	return len(cache.entries)
}

func (server *EffectivePermissionServer) Describe(ch chan<- *prometheus.Desc) {
	if server == nil {
		return
	}
	ch <- server.metrics.requestsDesc
	ch <- server.metrics.durationDesc
	ch <- server.metrics.responseBytesDesc
	ch <- server.metrics.entriesDesc
}

func (server *EffectivePermissionServer) Collect(ch chan<- prometheus.Metric) {
	if server == nil {
		return
	}
	ch <- prometheus.MustNewConstMetric(
		server.metrics.requestsDesc,
		prometheus.CounterValue,
		float64(server.metrics.hits.Load()),
		"hit",
	)
	ch <- prometheus.MustNewConstMetric(
		server.metrics.requestsDesc,
		prometheus.CounterValue,
		float64(server.metrics.misses.Load()),
		"miss",
	)
	ch <- prometheus.MustNewConstMetric(
		server.metrics.durationDesc,
		prometheus.CounterValue,
		time.Duration(server.metrics.lookupNanoseconds.Load()).Seconds(),
		"lookup",
	)
	ch <- prometheus.MustNewConstMetric(
		server.metrics.durationDesc,
		prometheus.CounterValue,
		time.Duration(server.metrics.cloneNanoseconds.Load()).Seconds(),
		"clone",
	)
	ch <- prometheus.MustNewConstMetric(
		server.metrics.responseBytesDesc,
		prometheus.CounterValue,
		float64(server.metrics.responseBytes.Load()),
	)
	ch <- prometheus.MustNewConstMetric(
		server.metrics.entriesDesc,
		prometheus.GaugeValue,
		float64(server.cache.len()),
	)
}

func semanticEffectivePermissions(
	projected *contract.EffectivePermissionsResult,
	view *catalogsnapshot.RuntimeMetadataView,
	receipts recordsemantic.Receipts,
) (permissionsemantic.Response, error) {
	return semanticEffectivePermissionsSelected(projected, view, receipts, nil)
}

func semanticEffectivePermissionsSelected(
	projected *contract.EffectivePermissionsResult,
	view *catalogsnapshot.RuntimeMetadataView,
	receipts recordsemantic.Receipts,
	selection *permissionsemantic.Selection,
) (permissionsemantic.Response, error) {
	if projected == nil || view == nil || !view.SupportsEffectivePermissionServing() {
		return permissionsemantic.Response{}, &recordsemantic.Failure{
			Category: recordsemantic.FailureInternal,
		}
	}
	response := permissionsemantic.Response{
		ObjectPermissions: make(
			[]permissionsemantic.ObjectPermission, 0, len(projected.ObjectPermissions),
		),
		FieldPermissions: make(
			[]permissionsemantic.FieldPermission, 0, len(projected.FieldPermissions),
		),
		ApplicationPermissions: make(
			[]permissionsemantic.ApplicationPermission, 0,
			len(projected.ApplicationPermissions),
		),
		NavigationPermissions: make(
			[]permissionsemantic.NavigationPermission, 0,
			len(projected.NavigationPermissions),
		),
		Receipts: receiptsForCapability(
			receipts, permissionsemantic.CapabilityName,
		),
	}
	if selection.Requests(permissionsemantic.SectionSystemPermissions) {
		response.SystemPermissions = permissionGrantProjection(projected.SystemPermissions)
	}
	if selection.Requests(permissionsemantic.SectionCustomPermissions) {
		response.CustomPermissions = permissionGrantProjection(projected.CustomPermissions)
	}
	selectedResources := make(map[string]struct{})
	if selection != nil {
		selectedResources = make(map[string]struct{}, len(selection.ResourceTypes))
		for _, resourceType := range selection.ResourceTypes {
			selectedResources[permissionIdentityKey(resourceType)] = struct{}{}
		}
	}
	resourceSelected := func(resourceType string) bool {
		if selection == nil {
			return true
		}
		_, ok := selectedResources[permissionIdentityKey(resourceType)]
		return ok
	}
	decisionObjects := view.Objects()
	fieldsByObject := make(map[string]map[string]struct{}, len(decisionObjects))
	for _, object := range decisionObjects {
		if object == nil || !resourceSelected(object.APIName) {
			continue
		}
		fields := make(map[string]struct{}, len(object.Fields))
		for _, field := range object.Fields {
			fields[permissionIdentityKey(field.APIName)] = struct{}{}
		}
		fieldsByObject[permissionIdentityKey(object.APIName)] = fields
	}
	if selection.Requests(permissionsemantic.SectionObjectPermissions) {
		for _, permission := range projected.ObjectPermissions {
			if _, included := fieldsByObject[permissionIdentityKey(permission.ResourceType)]; !included {
				continue
			}
			response.ObjectPermissions = append(
				response.ObjectPermissions,
				permissionsemantic.ObjectPermission{
					ResourceType:  permission.ResourceType,
					CanRead:       permission.CanRead,
					CanCreate:     permission.CanCreate,
					CanEdit:       permission.CanEdit,
					CanDelete:     permission.CanDelete,
					CanDeactivate: permission.CanDeactivate,
					CanViewAll:    permission.CanViewAll,
					CanModifyAll:  permission.CanModifyAll,
				},
			)
		}
	}
	sort.Slice(response.ObjectPermissions, func(i, j int) bool {
		return response.ObjectPermissions[i].ResourceType <
			response.ObjectPermissions[j].ResourceType
	})
	if selection.Requests(permissionsemantic.SectionFieldPermissions) {
		for _, permission := range projected.FieldPermissions {
			fields, included := fieldsByObject[permissionIdentityKey(permission.ResourceType)]
			if !included {
				continue
			}
			if _, included := fields[permissionIdentityKey(permission.FieldName)]; !included {
				continue
			}
			response.FieldPermissions = append(
				response.FieldPermissions,
				permissionsemantic.FieldPermission{
					ResourceType: permission.ResourceType,
					FieldName:    permission.FieldName,
					CanCreate:    permission.CanCreate,
					CanRead:      permission.CanRead,
					CanEdit:      permission.CanEdit,
				},
			)
		}
	}
	sort.Slice(response.FieldPermissions, func(i, j int) bool {
		left := response.FieldPermissions[i]
		right := response.FieldPermissions[j]
		if left.ResourceType != right.ResourceType {
			return left.ResourceType < right.ResourceType
		}
		return left.FieldName < right.FieldName
	})
	if selection.Requests(permissionsemantic.SectionApplicationPermissions) {
		for _, permission := range projected.ApplicationPermissions {
			response.ApplicationPermissions = append(
				response.ApplicationPermissions,
				permissionsemantic.ApplicationPermission{
					ApplicationID: permission.ApplicationID,
					CanView:       permission.CanView,
					IsDefault:     permission.IsDefault,
				},
			)
		}
	}
	sort.Slice(response.ApplicationPermissions, func(i, j int) bool {
		return response.ApplicationPermissions[i].ApplicationID <
			response.ApplicationPermissions[j].ApplicationID
	})
	if selection.Requests(permissionsemantic.SectionNavigationPermissions) {
		for _, permission := range projected.NavigationPermissions {
			response.NavigationPermissions = append(
				response.NavigationPermissions,
				permissionsemantic.NavigationPermission{
					NavigationKey: permission.NavigationKey,
					CanView:       permission.CanView,
				},
			)
		}
	}
	sort.Slice(response.NavigationPermissions, func(i, j int) bool {
		return response.NavigationPermissions[i].NavigationKey <
			response.NavigationPermissions[j].NavigationKey
	})
	recordTypeGrants := make(
		map[string]models.PermissionSetRecordTypeVisibility,
		len(projected.RecordTypePermissions),
	)
	for recordTypeID, visible := range projected.RecordTypePermissions {
		recordTypeGrants[recordTypeID] = models.PermissionSetRecordTypeVisibility{
			RecordTypeID: recordTypeID,
			IsVisible:    visible,
		}
	}
	if selection.Requests(permissionsemantic.SectionRecordTypePermissions) {
		for _, object := range view.EffectivePermissionObjects() {
			if !resourceSelected(object.ResourceType) {
				continue
			}
			recordTypeModels := make([]*models.RecordType, 0, len(object.RecordTypes))
			for _, recordType := range object.RecordTypes {
				recordTypeModels = append(recordTypeModels, &models.RecordType{
					ID:            recordType.RecordTypeID,
					ObjectAPIName: object.ResourceType,
					DeveloperName: recordType.DeveloperName,
					Name:          recordType.Name,
					IsActive:      true,
				})
			}
			grants, explicit := recordtypes.FilterGrantsForObject(
				recordTypeModels, recordTypeGrants,
			)
			for _, entry := range recordtypes.BuildRawAccessSurface(
				recordTypeModels, grants, explicit,
			).Entries {
				// Master is a Salesforce projection, not a stored RecordType
				// definition or a subject-specific permission fact. L1 synthesizes
				// it after joining these concrete decisions with the same-revision
				// effective RecordType component.
				if entry.Master {
					continue
				}
				response.RecordTypePermissions = append(
					response.RecordTypePermissions,
					permissionsemantic.RecordTypePermission{
						ResourceType: object.ResourceType,
						RecordTypeID: entry.ID,
						Available:    entry.Available,
						IsDefault:    entry.IsDefault,
					},
				)
			}
		}
	}
	sort.Slice(response.RecordTypePermissions, func(i, j int) bool {
		left := response.RecordTypePermissions[i]
		right := response.RecordTypePermissions[j]
		if left.ResourceType != right.ResourceType {
			return left.ResourceType < right.ResourceType
		}
		return left.RecordTypeID < right.RecordTypeID
	})
	return response, nil
}

func permissionIdentityKey(value string) string {
	return strings.ToUpper(strings.TrimSpace(value))
}

func permissionGrantProjection(
	permissions map[string]bool,
) []permissionsemantic.PermissionGrant {
	result := make(
		[]permissionsemantic.PermissionGrant, 0, len(permissions),
	)
	for permissionID, granted := range permissions {
		result = append(result, permissionsemantic.PermissionGrant{
			PermissionID: permissionID,
			Granted:      granted,
		})
	}
	sort.Slice(result, func(i, j int) bool {
		return result[i].PermissionID < result[j].PermissionID
	})
	return result
}

func classifyEffectivePermissionError(ctx context.Context, err error) error {
	if ctxErr := ctx.Err(); ctxErr != nil {
		return ctxErr
	}
	var adminError *contract.PermissionAdminError
	if errors.As(err, &adminError) && adminError != nil {
		switch adminError.Kind {
		case contract.PermissionAdminErrorForbidden:
			return &recordsemantic.Failure{
				Category: recordsemantic.FailureForbidden,
			}
		case contract.PermissionAdminErrorNotFound:
			return &recordsemantic.Failure{
				Category: recordsemantic.FailureMissing,
			}
		default:
			return &recordsemantic.Failure{
				Category: recordsemantic.FailureInternal,
			}
		}
	}
	return classifyPlatformEngineError(
		ctx, err, permissionsemantic.InvalidComponentOperation,
	)
}

var _ runtimev1.EffectivePermissionServiceServer = (*EffectivePermissionServer)(nil)