package rbac

import (
	"regexp"
	"strings"

	"github.com/pingcap/dbaas/central/db/entity"
)

const (
	ReadOperation  = "read"
	WriteOperation = "write"

	AllResource  = "*"
	AllOperation = "*"
)

func HasPrivilege(roles []entity.Role, resource string, operation string) bool {
	for _, role := range roles {
		for _, privilege := range role.Privileges.Privileges {
			if (privilege.Resource == AllResource || privilege.Resource == resource) && matchOperation(operation, privilege.Operation) {
				return true
			}
			r, err := regexp.Compile(privilege.Resource)
			if err == nil && r.MatchString(resource) && matchOperation(operation, privilege.Operation) {
				return true
			}
		}
	}
	return false
}

func matchOperation(operation, allowed string) bool {
	upperCase := strings.ToUpper(allowed)
	if upperCase == AllOperation || upperCase == strings.ToUpper(WriteOperation) || upperCase == strings.ToUpper(operation) {
		return true
	}
	r, err := regexp.Compile(allowed)
	return err == nil && r.MatchString(operation)
}