"use client";

import * as React from "react";

import type { CurrentUserPermissions } from "../types";
import {
  canPersistModule,
  canReviewModule,
  canSuggestModule,
  getWorkflowRestrictionLabel,
  isReviewerProfile,
  isSuggesterOnlyProfile,
  resolveSuperAdmin,
} from "../lib/permission-capabilities";

type PermissionsContextValue = {
  permissions: string[];
  isSuperAdmin: boolean;
  can: (permission: string) => boolean;
  canAny: (permissions: string[]) => boolean;
  canSave: (module: string) => boolean;
  canSuggest: (module: string) => boolean;
  canReview: (module: string) => boolean;
  isSuggesterOnly: boolean;
  isReviewer: boolean;
  workflowRestrictionLabel: string | null;
  refresh: () => void;
};

const PermissionsContext = React.createContext<PermissionsContextValue | null>(null);
const emptyPermissionsUser: CurrentUserPermissions = {
  id: 0,
  principal: "",
  displayName: "",
  email: "",
  permissions: [],
  isSuperAdmin: false,
};

/**
 * Every capability in this object is derived from the SAME resolved `isSuperAdmin`.
 *
 * Previously `can`, `canAny` and `canSave` used the resolved flag while `canSuggest`,
 * `canReview`, `isSuggesterOnly` and `isReviewer` re-derived super-admin from the
 * permission list alone. A session carrying the flag but not the `system.super_admin`
 * string therefore reported "can save" and "cannot review" at once, and could be labelled
 * a Suggester. `resolveSuperAdmin` is now applied once, here, and threaded down.
 */
function buildPermissionHelpers(permissions: string[], isSuperAdmin: boolean) {
  const can = (permission: string) => {
    if (isSuperAdmin) return true;
    return permissions.includes(permission);
  };

  const canAny = (perms: string[]) => {
    if (isSuperAdmin) return true;
    return perms.some((p) => permissions.includes(p));
  };

  return {
    permissions,
    isSuperAdmin,
    can,
    canAny,
    canSave: (module: string) => canPersistModule(permissions, module, isSuperAdmin),
    canSuggest: (module: string) => canSuggestModule(permissions, module, isSuperAdmin),
    canReview: (module: string) => canReviewModule(permissions, module, isSuperAdmin),
    isSuggesterOnly: isSuggesterOnlyProfile(permissions, isSuperAdmin),
    isReviewer: isReviewerProfile(permissions, isSuperAdmin),
    workflowRestrictionLabel: getWorkflowRestrictionLabel(permissions, isSuperAdmin),
  };
}

/** The single place a `CurrentUserPermissions` is collapsed into helper inputs. */
function helpersForUser(user: CurrentUserPermissions) {
  return buildPermissionHelpers(
    user.permissions,
    resolveSuperAdmin(user.permissions, user.isSuperAdmin),
  );
}

export function PermissionsProvider({
  children,
  currentUser,
}: {
  children: React.ReactNode;
  currentUser?: CurrentUserPermissions;
}) {
  const [tick, setTick] = React.useState(0);

  const value = React.useMemo(() => {
    void tick;

    return {
      ...helpersForUser(currentUser ?? emptyPermissionsUser),
      refresh: () => setTick((n) => n + 1),
    };
  }, [currentUser, tick]);

  return <PermissionsContext.Provider value={value}>{children}</PermissionsContext.Provider>;
}

export function usePermissions() {
  const ctx = React.useContext(PermissionsContext);
  if (!ctx) {
    return {
      ...helpersForUser(emptyPermissionsUser),
      refresh: () => undefined,
    };
  }
  return ctx;
}