import prisma from "@/lib/prisma";

// 권한 확인: userId가 주어지면 역할 → 권한 매핑(RolePermission)으로 검사
export async function checkPermission(options: {
  userId: string | null | undefined;
  resource: "BOARD" | "POST" | "COMMENT" | "USER" | "ADMIN";
  action: "READ" | "CREATE" | "UPDATE" | "DELETE" | "MODERATE" | "ADMINISTER";
}): Promise<boolean> {
  const { userId, resource, action } = options;
  if (!userId) return false;

  const userRoles = await prisma.userRole.findMany({
    where: { userId },
    select: { roleId: true },
  });
  if (userRoles.length === 0) return false;
  const roleIds = userRoles.map((r) => r.roleId);
  const has = await prisma.rolePermission.findFirst({
    where: {
      roleId: { in: roleIds },
      resource,
      action,
      allowed: true,
    },
    select: { id: true },
  });
  if (has) return true;
  // ADMIN.ADMINISTER 이면 모든 리소스/액션 허용
  const isAdmin = await prisma.rolePermission.findFirst({
    where: {
      roleId: { in: roleIds },
      resource: "ADMIN",
      action: "ADMINISTER",
      allowed: true,
    },
    select: { id: true },
  });
  return !!isAdmin;
}

export async function requirePermission(options: {
  userId: string | null | undefined;
  resource: "BOARD" | "POST" | "COMMENT" | "USER" | "ADMIN";
  action: "READ" | "CREATE" | "UPDATE" | "DELETE" | "MODERATE" | "ADMINISTER";
}): Promise<void> {
  const ok = await checkPermission(options);
  if (!ok) {
    const err = new Error("Forbidden");
    // @ts-expect-error attach status for route handlers
    err.status = 403;
    throw err;
  }
}


