package store

import (
	"database/sql"
	"fmt"
	"time"

	core "agent-system-core"
)

// UpsertPluginAccountChecked fences the node-level plugin registry write with
// the request actor's effective account state. Admin authorization belongs to
// the caller; an enabled account alone does not authorize plugin management.
func (s *Store) UpsertPluginAccountChecked(actor, id, dir string, m core.PluginManifest, allowImplicitDefault bool) error {
	return s.withEffectiveAccountWrite(actor, allowImplicitDefault, func(tx *sql.Tx, _ Account) error {
		_, err := tx.Exec(s.q(`INSERT INTO plugins(id,dir,manifest,enabled,loaded_at) VALUES(?,?,?,?,?)
			ON CONFLICT(id) DO UPDATE SET dir=excluded.dir, manifest=excluded.manifest, enabled=excluded.enabled, loaded_at=excluded.loaded_at`),
			id, dir, marshalJSON(m), 1, nowISO())
		return err
	})
}

// SetPluginSchemaVersionAccountChecked checks the stored version and writes it
// in the final actor-fenced transaction. It preserves the legacy loader's
// refusal to downgrade a plugin schema.
func (s *Store) SetPluginSchemaVersionAccountChecked(actor, pluginID string, version int, allowImplicitDefault bool) error {
	return s.withEffectiveAccountWrite(actor, allowImplicitDefault, func(tx *sql.Tx, _ Account) error {
		var current int
		err := tx.QueryRow(s.q(`SELECT version FROM plugin_schema WHERE plugin_id=?`), pluginID).Scan(&current)
		if err != nil && err != sql.ErrNoRows {
			return err
		}
		if version < current {
			return fmt.Errorf("plugins: %s: schema %d older than stored %d", pluginID, version, current)
		}
		_, err = tx.Exec(s.q(`INSERT INTO plugin_schema(plugin_id,version,updated_at) VALUES(?,?,?)
			ON CONFLICT(plugin_id) DO UPDATE SET version=excluded.version, updated_at=excluded.updated_at`),
			pluginID, version, time.Now().UTC().Format(time.RFC3339))
		return err
	})
}