package app

import (
	"context"
	"strings"

	"github.com/tidbcloud/AgentTeam/internal/core/domain"
	"github.com/tidbcloud/AgentTeam/internal/store/access"
	"github.com/tidbcloud/AgentTeam/internal/store/app/registry"
	"github.com/tidbcloud/AgentTeam/internal/store/app/runtime"
)

func (store *Store) filterAppInstallationsForWorkspaceMember(
	ctx context.Context,
	workspaceID string,
	workspaceMember access.HumanWorkspaceMember,
	installations []AppInstallationView,
) ([]AppInstallationView, error) {
	audienceByAppID, err := store.registryStore().LoadCatalogAudienceForMember(ctx, workspaceID, workspaceMember.Member.ID)
	if err != nil {
		return nil, err
	}
	isWorkspaceAdmin := access.HasWorkspaceAdminRole(domain.WorkspaceRole(workspaceMember.WorkspaceRole))
	visible := make([]AppInstallationView, 0, len(installations))
	for _, installation := range installations {
		installation.CanManageApp = false
		installation.CatalogVisibility = ""
		audience, attributed := audienceByAppID[strings.TrimSpace(installation.AppID)]
		attributedExternal := attributed && !registry.IsProductApp(installation.AppID, installation.AppSlug)
		if attributedExternal {
			installation.CatalogVisibility = audience.CatalogVisibility
			installation.CanManageApp = isWorkspaceAdmin || audience.CanManage
			if !installation.CanManageApp {
				if audience.CatalogVisibility != registry.CatalogVisibilityPublic {
					continue
				}
				// An ordinary member's public projection is intentionally identity-
				// only. Runtime configuration and connection metadata remain on the
				// management-authorized read model.
				installation.Config = nil
				// Keep required collection fields as empty JSON arrays rather than
				// null while still withholding every connection record.
				installation.Connections = []runtime.ConnectionView{}
				installation.Grants = nil
				installation.RuntimeCapability = nil
			}
		}
		if !attributedExternal && isWorkspaceAppInstallation(installation) {
			continue
		}
		visible = append(visible, installation)
	}
	return visible, nil
}

func isWorkspaceAppInstallation(installation AppInstallationView) bool {
	return !registry.IsProductApp(installation.AppID, installation.AppSlug) &&
		installation.RuntimeCapability != nil && installation.RuntimeCapability.Supported
}