package rbac

import (
	"net/http"

	"github.com/gin-gonic/gin"
	"github.com/tidbcloud/tiinf/monitor/tilog"
	"go.uber.org/zap"

	"github.com/tidbcloud/tidb-management-service/tidb-mgmt-portal/domain/entity"
	"github.com/tidbcloud/tidb-management-service/tidb-mgmt-portal/pkg/apimiddleware/grpcerror"
	"github.com/tidbcloud/tidb-management-service/tidb-mgmt-portal/pkg/consts"
)

type fakeRBACService struct{}

func newFakeRBACService() Service {
	return &fakeRBACService{}
}

func (m *fakeRBACService) CheckRBAC(ctx *gin.Context) {
	v, ok := ctx.Get(consts.XAuthUser)
	if !ok {
		grpcerror.NewOpenAPIError(ctx, http.StatusUnauthorized, consts.ErrUnauthenticated)
		return
	}
	user, ok := v.(*entity.User)
	if !ok {
		tilog.Error(ctx.Request.Context(), "failed to get user from context")
		grpcerror.NewOpenAPIError(ctx, http.StatusUnauthorized, consts.ErrUnauthenticated)
		return
	}

	err := setGrpcGatewayMetaData(ctx, user)
	if err != nil {
		tilog.Error(ctx, "set grpc rbck metadata failed", zap.Error(err))
		grpcerror.NewOpenAPIError(ctx, http.StatusForbidden, consts.ErrPermissionDenied)
		return
	}
}

func (m *fakeRBACService) CheckAllowList(ctx *gin.Context) {
	// do nothing
}