package billing

import (
	"errors"
	"fmt"
	"net/http"
	"strings"

	"github.com/tidbcloud/AgentTeam/internal/api"
	"github.com/tidbcloud/AgentTeam/internal/store/organization"
)

func (handler *Handler) authorizedOrganization(r api.AuthenticatedRequest) (organization.OrganizationSummary, error) {
	if handler == nil || !handler.enabled {
		return organization.OrganizationSummary{}, api.NewHTTPErrorWithCode(http.StatusServiceUnavailable, "Billing is disabled", billingErrorDisabled)
	}
	if handler.organizations == nil {
		return organization.OrganizationSummary{}, dependencyUnavailable(fmt.Errorf("billing dependency is not configured"))
	}
	workspaceID := billingWorkspaceID(r.Gin)
	if workspaceID == "" {
		return organization.OrganizationSummary{}, api.NewHTTPErrorWithCode(http.StatusBadRequest, "X-Workspace-Id is required", billingErrorInvalidInput)
	}
	org, err := handler.organizations.GetWorkspaceOrganizationForUser(r.Context(), r.UserID(), workspaceID)
	if err != nil {
		if errors.Is(err, organization.ErrForbidden) || errors.Is(err, organization.ErrNotFound) {
			return organization.OrganizationSummary{}, api.NewHTTPErrorWithCodeAndCause(http.StatusNotFound, "Billing organization not found", billingErrorNotFound, err)
		}
		return organization.OrganizationSummary{}, dependencyUnavailable(err)
	}
	if strings.TrimSpace(org.ID) == "" {
		return organization.OrganizationSummary{}, api.NewHTTPErrorWithCode(http.StatusNotFound, "Billing organization not found", billingErrorNotFound)
	}
	switch strings.TrimSpace(org.Role) {
	case "org_owner", "org_admin":
		return org, nil
	default:
		return organization.OrganizationSummary{}, api.NewHTTPErrorWithCode(http.StatusForbidden, "Billing requires organization owner or admin access", billingErrorForbidden)
	}
}