package app

import (
	"context"
	"strings"

	"github.com/tidbcloud/AgentTeam/internal/core/domain"
	"github.com/tidbcloud/AgentTeam/internal/coredb"
	"github.com/tidbcloud/AgentTeam/internal/store/access"
)

func requireGitHubSetupMode(member access.HumanWorkspaceMember, mode string) error {
	isAdmin := access.HasWorkspaceAdminRole(domain.WorkspaceRole(member.WorkspaceRole))
	switch strings.TrimSpace(mode) {
	case GitHubAppSetupModeAdmin:
		if !isAdmin {
			return ErrForbidden
		}
	case GitHubAppSetupModeRequester:
		if isAdmin {
			return ErrForbidden
		}
		if err := requireAppApprovalRequester(member); err != nil {
			return err
		}
	default:
		return badRequest("GitHub setup mode is invalid.")
	}
	return nil
}

func (store *Store) revalidateGitHubSetupMemberForUpdate(
	ctx context.Context,
	queryer coredb.QueryRower,
	userID string,
	workspaceID string,
	expected access.HumanWorkspaceMember,
) (access.HumanWorkspaceMember, error) {
	current, err := store.loadAuthorizedHumanWorkspaceMemberForUpdate(ctx, queryer, userID, workspaceID, workspaceAccessAction)
	if err != nil {
		return access.HumanWorkspaceMember{}, err
	}
	currentUserID, expectedUserID := "", ""
	if current.Member.UserID != nil {
		currentUserID = strings.TrimSpace(*current.Member.UserID)
	}
	if expected.Member.UserID != nil {
		expectedUserID = strings.TrimSpace(*expected.Member.UserID)
	}
	if strings.TrimSpace(current.Member.ID) != strings.TrimSpace(expected.Member.ID) ||
		strings.TrimSpace(current.Member.WorkspaceID) != strings.TrimSpace(workspaceID) ||
		strings.TrimSpace(expected.Member.WorkspaceID) != strings.TrimSpace(workspaceID) ||
		currentUserID != strings.TrimSpace(userID) || expectedUserID != strings.TrimSpace(userID) {
		return access.HumanWorkspaceMember{}, conflict("GitHub setup membership changed. Restart setup.")
	}
	return current, nil
}