package auth

import (
	"context"

	"github.com/tidbcloud/account/idl/pbgen/proto/account"
	authsdk "github.com/tidbcloud/tiinf/sdk/auth"

	accountcli "github.com/tidbcloud/tidb-management-service/tidb-mgmt-portal/domain/adapter/account"
)

func getProjectsByAPIKeyScope(
	ctx context.Context,
	accountClient accountcli.Client,
	apiKeyRsp *account.GetApiKeyByAccessKeyRsp,
) ([]*account.Project, error) {
	var projectIDs []uint64
	for _, item := range apiKeyRsp.GetResourceInfos() {
		if item.GetScopeType() == "ORG" && item.GetRole() == "org:owner" {
			return authsdk.ListProjectsFromApiKeyRsp(ctx, apiKeyRsp)
		}
		if item.GetScopeType() == "PROJECT" {
			projectIDs = append(projectIDs, item.GetResourceId())
		}
	}

	if len(projectIDs) == 0 {
		return authsdk.ListProjectsFromApiKeyRsp(ctx, apiKeyRsp)
	}

	return accountClient.ListProjects(ctx, projectIDs)
}

func projectIDsFromProjects(projects []*account.Project) []uint64 {
	ids := make([]uint64, 0, len(projects))
	for _, project := range projects {
		if project == nil {
			continue
		}
		ids = append(ids, project.GetId())
	}
	return ids
}