package server

import (
	"context"
	"net/http"

	"chat-agent-system/internal/auth"
)

func (s *Server) assertTaskRunOwnedByUser(w http.ResponseWriter, ctx context.Context, runID string, user *auth.UserAccount) bool {
	if user == nil {
		writeJSONResponse(w, http.StatusUnauthorized, map[string]string{
			"error_code": "ERR_UNAUTHENTICATED",
			"message":    "请先登录",
		})
		return false
	}
	rec, err := s.taskRuns.GetRun(runID)
	if err != nil {
		http.Error(w, "run not found", http.StatusNotFound)
		return false
	}
	if s.isSystemAdminUser(ctx, user) {
		return true
	}
	if rec.UserID > 0 && rec.UserID == user.ID {
		return true
	}
	if rec.ProjectID > 0 && s.authorizer != nil {
		if err := s.authorizer.RequireProjectAccess(ctx, rec.ProjectID, user.ID); err == nil {
			return true
		}
	}
	writeJSONResponse(w, http.StatusForbidden, map[string]string{
		"error_code": "ERR_FORBIDDEN",
		"message":    "无权访问该任务",
	})
	return false
}

func (s *Server) isSystemAdminUser(ctx context.Context, user *auth.UserAccount) bool {
	if user == nil {
		return false
	}
	admin, err := s.authzSvc.IsSystemAdmin(ctx, user.ID, user.RoleID)
	return err == nil && admin
}