package impl

import (
	"context"
	"fmt"
	"gitee.com/talk-about-articles/keyauth-tz/apps/policy"
	"gitee.com/talk-about-articles/keyauth-tz/apps/role"
	"github.com/infraboard/mcube/exception"
)

func (s *service) ValidatePermission(ctx context.Context, req *policy.ValidatePermissionRequest) (*policy.Policy, error) {

	// 根据用户,命名空间找到用户的授权策略
	// 由于使用分页，只查询20条数据
	fmt.Println("test1")
	query := policy.NewQueryPolicyRequest()
	query.Namespace = req.Namespace
	query.Username = req.Username
	// 调整最大策略条数
	query.Page.PageSize = 100

	set, err := s.QueryPolicy(ctx, query)
	if err != nil {
		return nil, err
	}
	// 获取用户的角色
	roles := set.Roles()

	// 通过role模块查询所有的role对象实例集合
	QueryReq := role.NewQueryRoleRequestWithNames(roles)

	s.log.Debug(QueryReq)

	roleList, err := s.role.QueryRole(ctx, QueryReq)
	if err != nil {
		return nil, err
	}
	s.log.Debug(roleList)
	// 根据Role判断用户角色是否有相应的权限
	check := role.NewCheckPermission(req.Service, req.Resource, req.Action)
	s.log.Debug(check)
	ok, role := roleList.HasPermission(check)
	if !ok {
		return nil, exception.NewPermissionDeny("validate permission error, not permission access service %s resource %s action %s", req.Service, req.Resource, req.Action)
	}

	// 查询角色对应的策略是什么
	policy_ins := set.GetPolicyByRole(role.Spec.Name)

	return policy_ins, err
}

func (s *service) QueryPolicy(ctx context.Context, req *policy.QueryPolicyRequest) (*policy.PolicySet, error) {

	query := newQueryPolicyRequest(req)
	return s.query(ctx, query)
}

func (s *service) CreatePolicy(ctx context.Context, req *policy.CreatePolicyRequest) (
	*policy.Policy, error) {
	ins, err := policy.NewPolicy(req)
	if err != nil {
		return nil, exception.NewBadRequest("validate create policy error, %s", err)
	}

	if err := s.save(ctx, ins); err != nil {
		return nil, err
	}

	return ins, nil
}