//go:build permitio

package cognitoauth

// TestUser represents a test user with their assigned roles
type TestUser struct {
	Key   string
	Name  string
	Email string
	Roles []string
}

// TestUsers contains the users configured in the Permit.io test environment
var TestUsers = []TestUser{
	{
		Key:   "e12bb510-30e1-7062-a69a-ca7f3f38d80e",
		Name:  "test user",
		Email: "betot75403@isorax.com",
		Roles: []string{"viewer", "editor"},
	},
	{
		Key:   "d12bf580-b071-7017-b1ff-a27961affc34",
		Name:  "john smith",
		Email: "work.jay@gmail.com",
		Roles: []string{"editor", "viewer"},
	},
}

// TestResource represents a resource with its available actions and role permissions
type TestResource struct {
	Name              string
	AvailableActions  []string
	RolePermissions   map[string][]string // role -> actions
}

// TestResources contains the resources configured in the Permit.io test environment
var TestResources = map[string]TestResource{
	"document": {
		Name:             "document",
		AvailableActions: []string{"create", "delete", "read", "update"},
		RolePermissions: map[string][]string{
			"admin":  {"create", "delete", "read", "update"},
			"editor": {"create", "read", "update"}, // delete is unchecked
			"viewer": {"read"},                     // only read is checked
		},
	},
}

// GetUserByKey returns a test user by their key
func GetUserByKey(key string) (TestUser, bool) {
	for _, user := range TestUsers {
		if user.Key == key {
			return user, true
		}
	}
	return TestUser{}, false
}

// GetUserByName returns a test user by their name
func GetUserByName(name string) (TestUser, bool) {
	for _, user := range TestUsers {
		if user.Name == name {
			return user, true
		}
	}
	return TestUser{}, false
}

// HasPermission checks if a user should have permission for a resource/action based on test configuration
func HasPermission(userKey, resource, action string) bool {
	user, exists := GetUserByKey(userKey)
	if !exists {
		return false
	}

	testResource, resourceExists := TestResources[resource]
	if !resourceExists {
		return false
	}

	// Check if any of the user's roles have permission for this action
	for _, userRole := range user.Roles {
		if allowedActions, roleExists := testResource.RolePermissions[userRole]; roleExists {
			for _, allowedAction := range allowedActions {
				if allowedAction == action {
					return true
				}
			}
		}
	}

	return false
}