package access

import (
	"context"
	"fmt"
	"strings"

	"github.com/tidbcloud/AgentTeam/internal/coredb"
)

// RequireActiveHumanMember verifies the referenced member is an active human
// member of the workspace, locking the member row when forUpdate is set.
func RequireActiveHumanMember(ctx context.Context, queryer coredb.QueryRower, workspaceID string, memberID string, forUpdate bool) error {
	query := `
SELECT type, status
FROM members
WHERE workspace_id = $1
  AND id = $2
LIMIT 1`
	if forUpdate {
		query += "\nFOR UPDATE"
	}
	var memberType, memberStatus string
	if err := queryer.QueryRow(ctx, query, strings.TrimSpace(workspaceID), strings.TrimSpace(memberID)).Scan(&memberType, &memberStatus); err != nil {
		if coredb.IsNotFound(err) {
			return ErrNotFound
		}
		return fmt.Errorf("verify active human member: %w", err)
	}
	if strings.TrimSpace(memberType) != "human" || strings.TrimSpace(memberStatus) != "active" {
		return ErrForbidden
	}
	return nil
}