package permissions

import (
	"context"
	"fmt"

	"github.com/nexuscrm/kernel/pkg/ports"
	"github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/permissionstatev1"
)

// LoadCurrentEffectivePermissionSnapshot exposes the repository's indivisible,
// version-qualified system/custom permission aggregate through the permission
// owner. Runtime admission paths use this instead of reopening the same
// aggregate once per permission family.
func (s *PermissionService) LoadCurrentEffectivePermissionSnapshot(
	ctx context.Context,
	subject permissionstatev1.Subject,
) (permissionstatev1.EffectiveSnapshot, error) {
	if s == nil || s.repo == nil {
		return permissionstatev1.EffectiveSnapshot{}, fmt.Errorf(
			"effective permission snapshot: permission owner is unavailable",
		)
	}
	repository, ok := s.repo.(ports.EffectivePermissionSnapshotRepository)
	if !ok {
		return permissionstatev1.EffectiveSnapshot{}, fmt.Errorf(
			"effective permission snapshot: aggregate repository is unavailable",
		)
	}
	return repository.LoadCurrentEffectivePermissionSnapshot(ctx, subject)
}