package dashboard

import (
	"fmt"

	sharedErrors "github.com/nexuscrm/shared/pkg/errors"
)

// validateFilters checks runtime filters against a whitelist of allowed keys
func (s *Service) validateFilters(filters map[string]interface{}) error {
	// Whitelist of allowed global filter keys
	// This prevents arbitrary field injection or internal variable overwrites
	allowedKeys := map[string]bool{
		"startDate": true, // Common date range
		"endDate":   true,
		"record":    true, // Record context (e.g., Account ID)
		"ownerId":   true, // View as user
		"name":      true, // Name filtering (e.g. search)
	}

	for k := range filters {
		// Allow "record.*" for specific field context if needed, but strict for now
		if !allowedKeys[k] {
			return sharedErrors.NewInvalidFieldError(fmt.Sprintf("disallowed filter key: %s", k), "filter")
		}
	}
	return nil
}