<?php

namespace MintyPHP\Module\Helpdesk;

use MintyPHP\Service\Access\AuthorizationDecision;
use MintyPHP\Service\Access\AuthorizationPolicyInterface;
use MintyPHP\Service\Access\PermissionService;

final class HelpdeskAuthorizationPolicy implements AuthorizationPolicyInterface
{
    public const ABILITY_ACCESS = 'helpdesk.access';
    public const ABILITY_SETTINGS_MANAGE = 'helpdesk.settings.manage';
    public const ABILITY_TEAM_WORKLOAD = 'helpdesk.team-workload.view';
    public const ABILITY_RISK_RADAR = 'helpdesk.risk-radar.view';

    public const PERMISSION_ACCESS = 'helpdesk.access';
    public const PERMISSION_SETTINGS_MANAGE = 'helpdesk.settings.manage';
    public const PERMISSION_TEAM_WORKLOAD = 'helpdesk.team-workload.view';
    public const PERMISSION_RISK_RADAR = 'helpdesk.risk-radar.view';

    public function __construct(
        private readonly PermissionService $permissionService
    ) {
    }

    public function supports(string $ability): bool
    {
        return in_array($ability, [self::ABILITY_ACCESS, self::ABILITY_SETTINGS_MANAGE, self::ABILITY_TEAM_WORKLOAD, self::ABILITY_RISK_RADAR], true);
    }

    public function authorize(string $ability, array $context = []): AuthorizationDecision
    {
        $actorUserId = (int) ($context['actor_user_id'] ?? 0);
        if ($actorUserId <= 0) {
            return AuthorizationDecision::deny(403, 'forbidden');
        }

        $permissionKey = match ($ability) {
            self::ABILITY_ACCESS => self::PERMISSION_ACCESS,
            self::ABILITY_SETTINGS_MANAGE => self::PERMISSION_SETTINGS_MANAGE,
            self::ABILITY_TEAM_WORKLOAD => self::PERMISSION_TEAM_WORKLOAD,
            self::ABILITY_RISK_RADAR => self::PERMISSION_RISK_RADAR,
            default => null,
        };

        if ($permissionKey === null) {
            return AuthorizationDecision::deny(403, 'forbidden');
        }

        if (!$this->permissionService->userHas($actorUserId, $permissionKey)) {
            return AuthorizationDecision::deny(403, 'forbidden');
        }

        return AuthorizationDecision::allow();
    }
}