package repositories

import (
	"agent-desk/internal/models"
	"agent-desk/internal/pkg/enums"
	"time"

	"gorm.io/gorm"
)

// These handwritten queries supplement the generated CRUD repositories.
func (r *roleRepository) FindEnabledByUser(db *gorm.DB, userID int64) ([]models.Role, error) {
	roles := make([]models.Role, 0)
	err := db.Table("t_role AS r").
		Select("r.*").
		Joins("JOIN t_user_role AS ur ON ur.role_id = r.id").
		Where("ur.user_id = ? AND r.status = ?", userID, enums.StatusOk).
		Order("r.sort_no ASC, r.id ASC").
		Scan(&roles).Error
	return roles, err
}

func (r *permissionRepository) FindEnabledCodesByUserRoles(db *gorm.DB, userID int64) ([]string, error) {
	codes := make([]string, 0)
	err := db.Table("t_permission AS p").
		Joins("JOIN t_role_permission AS rp ON rp.permission_id = p.id").
		Joins("JOIN t_role AS r ON r.id = rp.role_id").
		Joins("JOIN t_user_role AS ur ON ur.role_id = r.id").
		Where("ur.user_id = ? AND r.status = ? AND p.status = ?", userID, enums.StatusOk, enums.StatusOk).
		Distinct().Pluck("p.code", &codes).Error
	return codes, err
}

type UserPermissionOverride struct {
	Code   string
	Effect int
}

func (r *userPermissionRepository) FindActiveEnabledOverrides(db *gorm.DB, userID int64, now time.Time) ([]UserPermissionOverride, error) {
	overrides := make([]UserPermissionOverride, 0)
	err := db.Table("t_user_permission AS up").
		Select("p.code, up.effect").
		Joins("JOIN t_permission AS p ON p.id = up.permission_id").
		Where("up.user_id = ? AND p.status = ?", userID, enums.StatusOk).
		Where("up.expired_at IS NULL OR up.expired_at > ?", now).
		Scan(&overrides).Error
	return overrides, err
}

// GetAuthState deliberately excludes the bearer token; revalidation only needs
// the identity binding, revocation status, and absolute expiry.
func (r *loginSessionRepository) GetAuthState(db *gorm.DB, sessionID, userID int64) (*models.LoginSession, error) {
	session := &models.LoginSession{}
	if err := db.Select("id", "user_id", "expired_at", "revoked_at").
		Take(session, "id = ? AND user_id = ?", sessionID, userID).Error; err != nil {
		return nil, err
	}
	return session, nil
}

func (r *userRepository) GetAuthState(db *gorm.DB, userID int64) (*models.User, error) {
	user := &models.User{}
	if err := db.Select("id", "username", "nickname", "avatar", "user_type", "status", "deleted_at").
		Take(user, "id = ?", userID).Error; err != nil {
		return nil, err
	}
	return user, nil
}