package checker

import (
	"context"

	"google.golang.org/grpc"

	"github.com/tidbcloud/tidb-management-service/tidb-mgmt-service/domain/adapter/dedicatedglobal"
	"github.com/tidbcloud/tidb-management-service/tidb-mgmt-service/domain/adapter/nextgenglobal"
	"github.com/tidbcloud/tidb-management-service/tidb-mgmt-service/domain/adapter/serverlessglobal"
	"github.com/tidbcloud/tidb-management-service/tidb-mgmt-service/domain/repository"
)

type CheckFunc func(ctx context.Context, checkCtx *CheckContext, req any, info *grpc.UnaryServerInfo) (context.Context, any, error)

func (cf CheckFunc) Check(
	ctx context.Context,
	checkCtx *CheckContext,
	req any,
	info *grpc.UnaryServerInfo,
) (context.Context, any, error) {
	return cf(ctx, checkCtx, req, info)
}

// Checker checks whether target resources of req are in the ValidProjectList.
// The ValidProjectList is extracted by authn middleware and stored in ctx.
// In some case, Checker can also add new info to ctx.
type Checker interface {
	Check(
		ctx context.Context,
		checkCtx *CheckContext,
		req any,
		info *grpc.UnaryServerInfo,
	) (context.Context, any, error)
}

type CheckContext struct {
	ClusterRepo          repository.ClusterRepository
	MaintenanceTaskRepo  repository.MaintenanceTaskRepo
	DedicatedCli         dedicatedglobal.DedicatedGlobal
	NextGenCli           nextgenglobal.NextGenGlobal
	ServerlessCli        serverlessglobal.ServerlessGlobal
	DisableInternalCheck bool
	// This API key is a simple global-control-plane-singleton secret string
	//   that is used to check whether the caller can call our internal API and cluster proxy API.
	//   It is distributed by AWS Secret Manager.
	ApiKey string
}