package middleware

import (
	"net/http"

	"mengstack/internal/modules/rbac/application"

	"github.com/gin-gonic/gin"
)

type PermissionMiddleware struct {
	svc *application.Service
}

type RequirePermissionFunc func(permCode string) gin.HandlerFunc

func NewPermissionMiddleware(svc *application.Service) *PermissionMiddleware {
	return &PermissionMiddleware{svc: svc}
}

func (m *PermissionMiddleware) RequirePermission(permCode string) gin.HandlerFunc {
	return func(c *gin.Context) {
		userID, exists := c.Get("user_id")
		if !exists {
			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"code": -1, "message": "unauthorized"})
			return
		}

		has, err := m.svc.UserHasPermission(c.Request.Context(), userID.(uint), permCode)
		if err != nil {
			c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"code": -1, "message": "permission check failed"})
			return
		}
		if !has {
			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"code": -1, "message": "permission denied"})
			return
		}

		c.Next()
	}
}