package rbac

import (
	"github.com/jinzhu/gorm"
	"github.com/pingcap/tep/db/entity"
	"strings"
)

const (
	AllPrivilege            = "*"
	DeleteAndRestartCluster = "DeleteAndRestartCluster"
	OtherClusterOperation   = "OtherClusterOperation"
	DeleteAndOfflineMachine = "DeleteAndOfflineMachine"
	OtherMachineOperation   = "OtherMachineOperation"
	PlatformOperation       = "PlatformOperation"
	UserOperation           = "UserOperation"
)

var AllPrivilegeNameSet = map[string]bool{
	AllPrivilege:            true,
	DeleteAndRestartCluster: true,
	OtherClusterOperation:   true,
	DeleteAndOfflineMachine: true,
	OtherMachineOperation:   true,
	PlatformOperation:       true,
	UserOperation:           true,
}

func CanOperate(db *gorm.DB, username, action string) bool {
	//call from k8s api server
	if username == "" {
		return true
	}
	var user entity.User
	if db.Where("username=?", username).First(&user).Error != nil {
		return false
	}
	var userGroup entity.UserGroup
	if db.Where("group_name=?", user.Group).First(&user).Error != nil {
		return false
	}
	for _, item := range strings.Split(userGroup.Privileges, ",") {
		if action == item || item == AllPrivilege {
			return true
		}
	}
	return false
}