package serviceaccount

import (
	"context"
	"fmt"
	"strings"
)

// AllMembersAreActiveHumans verifies a bounded caller-provided member set
// without enumerating the workspace audience.
func (store *TxStore) AllMembersAreActiveHumans(ctx context.Context, workspaceID string, memberIDs []string) (bool, error) {
	q, err := txExecer(store)
	if err != nil {
		return false, err
	}
	workspaceID = trim(workspaceID)
	if workspaceID == "" {
		return false, badRequest("workspaceId is required")
	}
	members := make([]string, 0, len(memberIDs))
	seen := make(map[string]struct{}, len(memberIDs))
	for _, memberID := range memberIDs {
		memberID = trim(memberID)
		if memberID == "" {
			continue
		}
		if _, exists := seen[memberID]; exists {
			continue
		}
		seen[memberID] = struct{}{}
		members = append(members, memberID)
	}
	if len(members) == 0 {
		return true, nil
	}
	args := make([]any, 0, len(members)+1)
	args = append(args, workspaceID)
	placeholders := make([]string, 0, len(members))
	for index, memberID := range members {
		args = append(args, memberID)
		placeholders = append(placeholders, fmt.Sprintf("$%d", index+2))
	}
	var activeCount int64
	query := `
SELECT COUNT(*)
FROM members
WHERE workspace_id = $1
  AND type = 'human'
  AND status = 'active'
  AND id IN (` + strings.Join(placeholders, ", ") + `)
`
	if err := q.QueryRow(ctx, query, args...).Scan(&activeCount); err != nil {
		return false, fmt.Errorf("validate active Human members for service account materialization: %w", err)
	}
	return activeCount == int64(len(members)), nil
}