package api

import (
	"net/http"

	"github.com/gin-gonic/gin"
	"github.com/tcs-iptv/tcs/internal/httpx"
)

// RBACHandler RBAC 权限管理 API 处理器。
type RBACHandler struct {
	rbac *httpx.RBACManager
}

// NewRBACHandler 创建 RBAC 管理 API 处理器。
func NewRBACHandler(rbac *httpx.RBACManager) *RBACHandler {
	return &RBACHandler{rbac: rbac}
}

// Register 注册 RBAC 管理路由（应挂载在监管主体权限组下）。
func (h *RBACHandler) Register(rg *gin.RouterGroup) {
	rg.GET("/admin/rbac/roles", h.listRoles)
	rg.GET("/admin/rbac/permissions/:role", h.listPermissions)
	rg.PUT("/admin/rbac/roles/:role", h.setRolePermissions)
	rg.POST("/admin/rbac/grant", h.grantPermission)
	rg.POST("/admin/rbac/revoke", h.revokePermission)
}

func (h *RBACHandler) listRoles(c *gin.Context) {
	roles := h.rbac.ListRoles()
	httpx.OK(c, roles)
}

func (h *RBACHandler) listPermissions(c *gin.Context) {
	role := c.Param("role")
	perms := h.rbac.ListPermissions(role)
	httpx.OK(c, perms)
}

type setPermissionsReq struct {
	Permissions []string `json:"permissions"`
}

func (h *RBACHandler) setRolePermissions(c *gin.Context) {
	role := c.Param("role")
	var req setPermissionsReq
	if err := c.ShouldBindJSON(&req); err != nil {
		httpx.Error(c, http.StatusBadRequest, "INVALID_REQUEST", err.Error())
		return
	}
	perms := make([]httpx.Permission, len(req.Permissions))
	for i, p := range req.Permissions {
		perms[i] = httpx.Permission(p)
	}
	h.rbac.SetRolePermissions(role, perms)
	httpx.OK(c, gin.H{"role": role, "permissions": req.Permissions})
}

type grantRevokeReq struct {
	Role       string `json:"role"`
	Permission string `json:"permission"`
}

func (h *RBACHandler) grantPermission(c *gin.Context) {
	var req grantRevokeReq
	if err := c.ShouldBindJSON(&req); err != nil {
		httpx.Error(c, http.StatusBadRequest, "INVALID_REQUEST", err.Error())
		return
	}
	h.rbac.GrantPermission(req.Role, httpx.Permission(req.Permission))
	httpx.OK(c, gin.H{"role": req.Role, "permission": req.Permission, "granted": true})
}

func (h *RBACHandler) revokePermission(c *gin.Context) {
	var req grantRevokeReq
	if err := c.ShouldBindJSON(&req); err != nil {
		httpx.Error(c, http.StatusBadRequest, "INVALID_REQUEST", err.Error())
		return
	}
	h.rbac.RevokePermission(req.Role, httpx.Permission(req.Permission))
	httpx.OK(c, gin.H{"role": req.Role, "permission": req.Permission, "revoked": true})
}