package web

import (
	"strconv"

	"gardomatic.kleiax.de/lib/client"
)

type roleEditorRole struct {
	Name        string
	Label       string
	Permissions []string
	Editable    bool
	EditLabel   bool
	Deletable   bool
}

type roleEditorData struct {
	ID           string
	Title        string
	Description  string
	Scope        string
	Roles        []roleEditorRole
	Permissions  []permissionOption
	CreateAction string
	UpdateAction string
	DeleteAction string
	CSRFToken    string
	Garden       *client.Garden
}

func globalRoleEditor(id, title, description, scope string, roles []client.Role, permissions []permissionOption, csrfToken string) roleEditorData {
	result := roleEditorData{ID: id, Title: title, Description: description, Scope: scope, Permissions: permissions, CreateAction: webPath("admin.role.new"), UpdateAction: webPath("admin.role.update"), DeleteAction: webPath("admin.role.delete"), CSRFToken: csrfToken}
	for _, role := range roles {
		effective := []string{}
		for _, permission := range permissions {
			if clientRoleHasPermission(role, permission.Name) {
				effective = append(effective, permission.Name)
			}
		}
		result.Roles = append(result.Roles, roleEditorRole{Name: role.Name, Label: role.Label, Permissions: effective, Editable: role.Name != "owner", EditLabel: true, Deletable: !role.System})
	}
	return result
}

func gardenOverrideRoleEditor(gardenID int, roles []client.GardenRoleSetting, permissions []permissionOption, csrfToken string) roleEditorData {
	id := strconv.Itoa(gardenID)
	result := roleEditorData{ID: "garden-role-editor", Title: "Gartenspezifische Rollenrechte", Description: "Diese Einstellungen überschreiben die globalen Gartenrollen nur für diesen Garten.", Scope: "garden", Permissions: permissions, CreateAction: webPath("garden.role.new", id), UpdateAction: webPath("garden.role.update", id), DeleteAction: webPath("garden.role.delete", id), CSRFToken: csrfToken}
	for _, setting := range roles {
		result.Roles = append(result.Roles, roleEditorRole{Name: setting.Role.Name, Label: setting.Role.Label, Permissions: setting.EffectivePermissions, Editable: setting.Role.Name != "owner", Deletable: setting.Role.GardenID != nil})
	}
	return result
}

func clientRoleHasPermission(role client.Role, permission string) bool {
	for _, granted := range role.Permissions {
		if granted == permission || granted == "*" || granted == "garden:*" && permission != "garden:delete" {
			return true
		}
	}
	return false
}