package permissions

import (
	"strings"

	domainrls "github.com/nexuscrm/kernel/pkg/rls"
	"github.com/nexuscrm/shared/pkg/models"
)

const rowReadKindOwnerVisibility = "ownerVisibility"

func isOwnerVisibilityRowReadPolicy(policy *models.RowReadPolicy) bool {
	return policy != nil && strings.EqualFold(strings.TrimSpace(policy.Kind), rowReadKindOwnerVisibility)
}

func buildOwnerVisibilityFilter(policy *models.RowReadPolicy, user *models.UserSession) *domainrls.OwnerVisibilityFilter {
	if !isOwnerVisibilityRowReadPolicy(policy) || user == nil {
		return nil
	}
	visibilityField := strings.TrimSpace(policy.VisibilityField)
	if visibilityField == "" {
		return nil
	}
	return &domainrls.OwnerVisibilityFilter{
		UserID:              strings.TrimSpace(user.ID),
		OwnerField:          strings.TrimSpace(policy.OwnerField),
		VisibilityField:     visibilityField,
		OwnerVisibleValues:  compactStrings(policy.OwnerVisibleValues),
		PublicVisibleValues: compactStrings(policy.PublicVisibleValues),
	}
}

func checkOwnerVisibilityReadAccess(policy *models.RowReadPolicy, record models.SObject, user *models.UserSession) bool {
	filter := buildOwnerVisibilityFilter(policy, user)
	if filter == nil || record == nil {
		return false
	}

	visibility := recordStringValue(record[filter.VisibilityField])
	if visibility == "" {
		return false
	}
	if containsFold(filter.PublicVisibleValues, visibility) {
		return true
	}
	if filter.OwnerField == "" || filter.UserID == "" || !containsFold(filter.OwnerVisibleValues, visibility) {
		return false
	}
	return recordStringValue(record[filter.OwnerField]) == filter.UserID
}

func compactStrings(values []string) []string {
	out := make([]string, 0, len(values))
	for _, value := range values {
		value = strings.TrimSpace(value)
		if value != "" {
			out = append(out, value)
		}
	}
	return out
}

func containsFold(values []string, want string) bool {
	for _, value := range values {
		if strings.EqualFold(value, want) {
			return true
		}
	}
	return false
}