import { getDbPool } from "@/db";
import type { Session } from "@/lib/auth";
import { ensureCapitalTenant } from "@/lib/tenant";

export const isClientSession = (session: Session) => session.role.startsWith("client_");
export const canOperateCapital = (session: Session) => ["capital_admin", "capital_operator", "analyst"].includes(session.role);

/**
 * Clientes ficam sempre restritos ao próprio tenant. A operação Capital pode
 * escolher o cliente da vistoria por tenantId; sem seleção, usa o espaço interno
 * da Capital por compatibilidade com as rotas já existentes.
 */
export async function resolveInspectionTenant(session: Session, requestedTenantId?: string | null) {
  if (isClientSession(session)) return session.tenantId || null;
  if (!canOperateCapital(session)) return null;
  const tenantId = String(requestedTenantId || "").trim();
  if (!tenantId) return ensureCapitalTenant();
  const [rows] = await getDbPool().execute("SELECT id FROM tenants WHERE id = ? AND status = 'active' LIMIT 1", [tenantId]);
  return (rows as { id: string }[])[0]?.id || null;
}

/** Permissão efetiva por função do cliente, com compatibilidade ao perfil legado. */
export async function clientPermission(session: Session, field: "can_view_photos" | "can_manual_review" | "can_download_report") {
  if (!isClientSession(session) || !session.tenantId) return false;
  const db = getDbPool();
  try {
    const [rows] = await db.execute(`SELECT ${field} AS allowed FROM tenant_role_permissions WHERE tenant_id = ? AND role = ? LIMIT 1`, [session.tenantId, session.role]);
    const permission = (rows as { allowed?: number | boolean }[])[0];
    if (permission) return Boolean(permission.allowed);
  } catch { /* bases anteriores à migration 007 usam o perfil legado abaixo */ }
  const legacyField = field.replace("can_", "client_can_");
  const [rows] = await db.execute(`SELECT ${legacyField} AS allowed FROM tenant_access_profiles WHERE tenant_id = ? LIMIT 1`, [session.tenantId]);
  return Boolean((rows as { allowed?: number | boolean }[])[0]?.allowed);
}