package ws

import (
	"errors"
	"fmt"

	"silk-server-go/internal/model"

	"gorm.io/gorm"
)

// DeviceAuthorizer 校验用户是否有权读取指定设备。
type DeviceAuthorizer interface {
	CanReadDevice(userID, deviceKey string) (bool, error)
}

// DBDeviceAuthorizer 使用现有 RBAC 权限判断设备读取权；当前未做用户级资源 ACL。
type DBDeviceAuthorizer struct {
	db *gorm.DB
}

func NewDBDeviceAuthorizer(db *gorm.DB) *DBDeviceAuthorizer {
	return &DBDeviceAuthorizer{db: db}
}

func (a *DBDeviceAuthorizer) CanReadDevice(userID, deviceKey string) (bool, error) {
	if deviceKey == "" {
		return false, nil
	}

	var user model.User
	if err := a.db.Where("id = ?", userID).First(&user).Error; err != nil {
		return false, err
	}
	if user.Role == model.RoleAdmin {
		return true, nil
	}

	var count int64
	err := a.db.Table("role_permissions").
		Joins("JOIN permissions ON permissions.id = role_permissions.permission_id").
		Where("role_permissions.role = ? AND permissions.code = ?", user.Role, "device:read").
		Count(&count).Error
	return count > 0, err
}

func (h *Hub) authorizeSubscription(userID, deviceKey string) error {
	if h.authorizer == nil {
		return errors.New("device authorizer not configured")
	}
	ok, err := h.authorizer.CanReadDevice(userID, deviceKey)
	if err != nil {
		return err
	}
	if !ok {
		return fmt.Errorf("device subscription denied: %s", deviceKey)
	}
	return nil
}