package server

import (
	"context"
	"net/http"

	"chat-agent-system/internal/auth"
)

type principalContextKey struct{}

// withPrincipal 将已认证用户写入请求 context。
func withPrincipal(ctx context.Context, user *auth.UserAccount) context.Context {
	return context.WithValue(ctx, principalContextKey{}, user)
}

// principalFromContext 从 context 读取当前用户；未认证返回 nil。
func principalFromContext(ctx context.Context) *auth.UserAccount {
	if ctx == nil {
		return nil
	}
	user, _ := ctx.Value(principalContextKey{}).(*auth.UserAccount)
	return user
}

// principalFromRequest 从 HTTP 请求 context 读取当前用户。
func (s *Server) principalFromRequest(r *http.Request) *auth.UserAccount {
	return principalFromContext(r.Context())
}

// requirePrincipal 要求已认证用户，否则写入 401。
func (s *Server) requirePrincipal(w http.ResponseWriter, r *http.Request) (*auth.UserAccount, bool) {
	user := s.principalFromRequest(r)
	if user == nil {
		writeJSONResponse(w, http.StatusUnauthorized, map[string]string{
			"error_code": "ERR_UNAUTHENTICATED",
			"message":    "请先登录",
		})
		return nil, false
	}
	return user, true
}

// requireAdmin 要求系统管理员角色。
func (s *Server) requireAdmin(w http.ResponseWriter, r *http.Request) (*auth.UserAccount, bool) {
	return s.requireSystemAdmin(w, r)
}

// requireSystemAdmin 通过 AuthorizationService 判定系统管理员。
func (s *Server) requireSystemAdmin(w http.ResponseWriter, r *http.Request) (*auth.UserAccount, bool) {
	user, ok := s.requirePrincipal(w, r)
	if !ok {
		return nil, false
	}
	admin, err := s.authzSvc().IsSystemAdmin(r.Context(), user.ID, user.RoleID)
	if err != nil {
		writeJSONResponse(w, http.StatusInternalServerError, map[string]string{
			"error_code": "ERR_AUTHZ",
			"message":    "权限判定失败",
		})
		return nil, false
	}
	if !admin {
		writeJSONResponse(w, http.StatusForbidden, map[string]string{
			"error_code": "ERR_FORBIDDEN",
			"message":    "需要管理员权限",
		})
		return nil, false
	}
	return user, true
}

// requireSystemPermission 校验细粒度 system:*（或其它系统权限）。
// Phase-2：系统管理员授予全部；非管理员 fail-closed。
func (s *Server) requireSystemPermission(w http.ResponseWriter, r *http.Request, perm string) (*auth.UserAccount, bool) {
	user, ok := s.requirePrincipal(w, r)
	if !ok {
		return nil, false
	}
	if s.authzSvc() == nil {
		if s.failClosedAuthz() {
			writeJSONResponse(w, http.StatusForbidden, map[string]string{
				"error_code": "ERR_FORBIDDEN",
				"message":    "需要系统权限",
			})
			return nil, false
		}
		return user, true
	}
	allowed, err := s.authzSvc().HasSystemPermission(r.Context(), user.ID, user.RoleID, perm)
	if err != nil {
		writeJSONResponse(w, http.StatusInternalServerError, map[string]string{
			"error_code": "ERR_AUTHZ",
			"message":    "权限判定失败",
		})
		return nil, false
	}
	if !allowed {
		writeJSONResponse(w, http.StatusForbidden, map[string]string{
			"error_code": "ERR_FORBIDDEN",
			"message":    "需要系统权限",
		})
		return nil, false
	}
	return user, true
}