package middleware

import (
	"net/http"
	"slices"

	"github.com/gin-gonic/gin"

	"security-center-backend/internal/pkg/response"
	"security-center-backend/internal/service/jwt"
)

func Permission(required string) gin.HandlerFunc {
	return func(c *gin.Context) {
		claimsValue, exists := c.Get("current_user")
		if !exists {
			response.Error(c, http.StatusUnauthorized, "not authenticated")
			c.Abort()
			return
		}
		claims, ok := claimsValue.(*jwt.Claims)
		if !ok {
			response.Error(c, http.StatusUnauthorized, "invalid session")
			c.Abort()
			return
		}
		if required == "" || hasRole(claims.Roles, "admin") || hasPermission(claims.Permissions, required) {
			c.Next()
			return
		}
		response.Error(c, http.StatusForbidden, "insufficient permissions")
		c.Abort()
	}
}

func hasRole(roles []string, target string) bool {
	return slices.Contains(roles, target)
}

func hasPermission(perms []string, target string) bool {
	return slices.Contains(perms, target)
}