package constants

import contractconstants "github.com/pingcap-inc/nexuscrm-contract/pkg/constants"

// Permission represents a Salesforce-style system permission
type Permission = contractconstants.Permission

// ObjectCRUD operations - Salesforce-native format (PascalCase values)
// These are string constants to match existing callsites
const (
	PermRead      = "Read"
	PermCreate    = "Create"
	PermEdit      = "Edit"
	PermDelete    = "Delete"
	PermViewAll   = "ViewAll"
	PermModifyAll = "ModifyAll"

	PermViewAllRecords   = "ViewAllRecords"
	PermModifyAllRecords = "ModifyAllRecords"

	// System Permissions
	PermViewAllRecycleBin = "ViewAllRecycleBin"
)

// System Permissions - Salesforce API names
// https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_profile.htm
const (
	// ========== Administrative ==========
	PermApiEnabled             Permission = "ApiEnabled"
	PermModifyAllData          Permission = "ModifyAllData"
	PermViewAllData            Permission = "ViewAllData"
	PermCustomizeApplication   Permission = "CustomizeApplication"
	PermManageUsers            Permission = "ManageUsers"
	PermManageRoles            Permission = "ManageRoles"
	PermManageNamedCredentials Permission = contractconstants.PermManageNamedCredentials
	PermManageProfilesPermSets Permission = "ManageProfilesPermSets"
	PermAssignPermissionSets   Permission = "AssignPermissionSets"
	PermManageSharing          Permission = "ManageSharing"
	PermResetPasswords         Permission = "ResetPasswords"
	PermViewSetup              Permission = contractconstants.PermViewSetup
	PermViewAllUsers           Permission = "ViewAllUsers"

	// ========== User Management ==========
	PermManageExternalUsers  Permission = "ManageExternalUsers"
	PermPasswordNeverExpires Permission = "PasswordNeverExpires"
	PermUseIdentityFeatures  Permission = "UseIdentityFeatures"

	// ========== Data ==========
	PermBulkApiHardDelete Permission = "BulkApiHardDelete"
	PermExportReport      Permission = "ExportReport"
	PermMassInlineEdit    Permission = "MassInlineEdit"
	PermDataExport        Permission = "DataExport"
	PermTransferAnyEntity Permission = "TransferAnyEntity"

	// ========== Reports & Dashboards ==========
	PermRunReports                Permission = "RunReports"
	PermCreateCustomizeReports    Permission = "CreateCustomizeReports"
	PermManageReportsInPubFolders Permission = "ManageReportsInPubFolders"
	PermManageDashbdsInPubFolders Permission = "ManageDashbdsInPubFolders"
	PermCreateDashboards          Permission = "CreateDashboards"
	PermScheduleReports           Permission = "ScheduleReports"
	PermEditDashboards            Permission = "EditDashboards"
	PermViewMyTeamsDashboards     Permission = "ViewMyTeamsDashboards"

	// ========== Flow & Automation (NexusCRM uses Flows instead of Apex) ==========
	PermRunFlow                 Permission = "RunFlow"
	PermManageFlows             Permission = "ManageFlows"
	PermViewFlowDefinition      Permission = "ViewFlowDefinition"
	PermManageScheduledFlows    Permission = "ManageScheduledFlows" // NexusCRM
	PermDebugFlows              Permission = "DebugFlows"           // NexusCRM (replaces DebugApex)
	PermManageActions           Permission = "ManageActions"        // NexusCRM - record actions
	PermManageApprovalProcesses Permission = "ManageApprovalProcesses"

	// ========== Schema & Metadata ==========
	PermModifyMetadata          Permission = "ModifyMetadata"
	PermManageCustomPermissions Permission = "ManageCustomPermissions"
	PermManageCustomLabels      Permission = "ManageCustomLabels"

	// ========== Email ==========
	PermEmailSingle             Permission = "EmailSingle"
	PermEmailMass               Permission = "EmailMass"
	PermEmailTemplateManagement Permission = "EmailTemplateManagement"

	// ========== List Views ==========
	PermCreateCustomizeFilters Permission = "CreateCustomizeFilters"
	PermEditPublicFilters      Permission = "EditPublicFilters"

	// ========== Content & Files ==========
	PermManageContentPermissions Permission = "ManageContentPermissions"
	PermManageContentProperties  Permission = "ManageContentProperties"
	PermCreateContentSpace       Permission = "CreateContentSpace"

	// ========== Audit & Compliance ==========
	PermViewSetupAuditTrail   Permission = "ViewSetupAuditTrail"
	PermViewDataLeakageEvents Permission = "ViewDataLeakageEvents"
	PermViewEventLogFiles     Permission = "ViewEventLogFiles"
	PermViewFieldAuditTrail   Permission = "ViewFieldAuditTrail"

	// ========== Platform ==========
	PermLightningExperienceUser Permission = "LightningExperienceUser"

	// ========== Object Operations ==========
	PermEditPublicDocuments Permission = "EditPublicDocuments"
	PermEditReadonlyFields  Permission = "EditReadonlyFields"

	// ========== Integration (NexusCRM specific) ==========
	PermQueryAllFiles            Permission = "QueryAllFiles"
	PermViewPlatformEvents       Permission = "ViewPlatformEvents"
	PermPublishPlatformEvents    Permission = "PublishPlatformEvents"
	PermManageConnectedApps      Permission = "ManageConnectedApps"
	PermManageOAuthApps          Permission = "ManageOAuthApps"                           // NexusCRM
	PermViewConnectorHealth      Permission = contractconstants.PermViewConnectorHealth   // NexusCRM: read connector sync state + health view (NCRM-INT-05a)
	PermViewConnectorEvents      Permission = contractconstants.PermViewConnectorEvents   // NexusCRM: read connector dead-letter queue (NCRM-INT-05)
	PermReplayConnectorEvents    Permission = contractconstants.PermReplayConnectorEvents // NexusCRM: replay connector dead-letter queue (NCRM-INT-05)
	PermViewConnectorDiagnostics Permission = "ViewConnectorDiagnostics"                  // NexusCRM: read per-record connector sync diagnostics (lineage + last-attempt status) (#2107)
	PermViewOutboundDeliveries   Permission = "ViewOutboundDeliveries"                    // NexusCRM: read the outbound email/webhook delivery attempt log (#2116)
	PermResendOutboundDeliveries Permission = "ResendOutboundDeliveries"                  // NexusCRM: resend a recorded outbound delivery attempt (#2116)
)

// SuperUserCapability is the single platform capability that grants
// super-user behavior. Runtime code must check this capability through the
// permission/policy plane instead of matching a concrete profile ID.
const SuperUserCapability Permission = PermModifyAllData

func HasSuperUserCapability(systemPermissions map[string]bool) bool {
	if systemPermissions == nil {
		return false
	}
	return systemPermissions[string(SuperUserCapability)]
}

// Context Keys for permission storage in request context
const (
	ContextKeySystemPermissions = "system_permissions"
	ContextKeyCustomPermissions = "custom_permissions"
)

// Permission catalog is row-driven as of the permission-metadata refactor.
// Seed sources: platform and app-pack permission catalog payloads.
// Runtime read: PermissionService.ListSystemPermissions — reads
// _System_Permission rows. Adding a permission is a pack edit, not a Go
// edit. Admins can also create custom permission rows at runtime via the
// _System_CustomPermission table.
//
// The AllSystemPermissions() Go function + PermissionDefinition struct
// were deleted in P3 of that refactor.