package v1

import (
	"database/sql"
	"time"

	"gorm.io/plugin/soft_delete"
)

const TableNameCloudMemberRole = "cloud_member_role"

// CloudMemberRole mapped from table <cloud_member_role>.
type CloudMemberRole struct {
	ID             uint64                `json:"id" gorm:"primary_key;AUTO_INCREMENT;column:id"`
	CreatedAt      time.Time             `json:"createdAt" gorm:"column:createdAt"`
	UpdatedAt      sql.NullTime          `json:"updatedAt" gorm:"column:updatedAt"`
	DeletedAt      sql.NullTime          `json:"deletedAt" gorm:"column:deletedAt"`
	ProviderID     uint64                `json:"providerID" gorm:"column:providerID"`
	Provider       CloudProvider         `json:"provider" gorm:"foreignkey:ProviderID;references:ID"`
	Code           string                `json:"code" gorm:"column:code;type:varchar(191);not null"`
	Name           string                `json:"name" gorm:"column:name"`
	Desc           string                `json:"desc" gorm:"column:desc"`
	NameInProvider string                `json:"nameInProvider" gorm:"column:nameInProvider"`
	Weight         int                   `json:"weight" gorm:"column:weight"`
	IsDel          soft_delete.DeletedAt `json:"isDel" gorm:"column:isDel;softDelete:flag,DeletedAtField:DeletedAt"`
}

// TableName CloudMemberRole's table name.
func (*CloudMemberRole) TableName() string {
	return TableNameCloudMemberRole
}

type RoleMembers struct {
	Role    *CloudMemberRole
	Members []*User
}

const (
	Add = iota + 1
	Delete
	DeleteAll
)

// GCPAllowedRoles temporary struct for role member.
var GCPAllowedRoles = map[string]bool{
	"roles/browser": true,
	"roles/editor":  true,
	"roles/owner":   true,
	"roles/viewer":  true,
}

var AWSAllowedRoles = map[string]bool{
	"arn:aws:sso:::permissionSet/ssoins-7758e707bb6ea352/ps-e4c0638798671e00": true, // DBaaS DevLeader
	"arn:aws:sso:::permissionSet/ssoins-7758e707bb6ea352/ps-102a524501af518f": true, // DBaaS DevUser
	"arn:aws:sso:::permissionSet/ssoins-7758e707bb6ea352/ps-fe34645020839e56": true, // DBaaS-Dev-ReadOnly-Role
	"arn:aws:sso:::permissionSet/ssoins-7758e707bb6ea352/ps-1664e13ffe50a40e": true, // DBaaS-Infra-DevUser-Role
}

// Azure 角色 GUID 定义
var AzureRoleGUIDs = map[string]bool{
	"8e3af657-a8ff-443c-a75c-2fe8c4bcb635": true, // Owner
	"b24988ac-6180-42a0-ab88-20f7382dd24c": true, // Contributor
	"acdd72a7-3385-48ef-bd42-f606fba81ae7": true, // Reader
	"18d7d88d-d35e-4fb5-a5c3-7773c20a72d9": true, // User Access Administrator
}

var AzureAllowedRoles = map[string]bool{
	"/subscriptions/{subscription-id}/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635": true, // Owner
	"/subscriptions/{subscription-id}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c": true, // Contributor
	"/subscriptions/{subscription-id}/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7": true, // Reader
	"/subscriptions/{subscription-id}/providers/Microsoft.Authorization/roleDefinitions/18d7d88d-d35e-4fb5-a5c3-7773c20a72d9": true, // User Access Administrator
	// Real subscription roles for testing
	"/subscriptions/e834db5d-17aa-49b1-95e5-0ecf42055027/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635": true, // Owner
	"/subscriptions/e834db5d-17aa-49b1-95e5-0ecf42055027/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c": true, // Contributor
	"/subscriptions/e834db5d-17aa-49b1-95e5-0ecf42055027/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7": true, // Reader
	"/subscriptions/e834db5d-17aa-49b1-95e5-0ecf42055027/providers/Microsoft.Authorization/roleDefinitions/18d7d88d-d35e-4fb5-a5c3-7773c20a72d9": true, // User Access Administrator
}