package service

import "browser.local/platform/domain"

func (svc *CoreService) authorizeServerLifecycle(sessionID string, serverInstanceID string) error {
	user, err := svc.GetCurrentUser(sessionID)
	if err != nil {
		return err
	}
	instance, err := svc.store.ServerInstances().Get(serverInstanceID)
	if err != nil {
		return err
	}
	if !canAccessServer(user, instance) {
		return ErrForbidden
	}
	return nil
}

func (svc *CoreService) requireServerOwner(sessionID string, serverInstanceID string) (domain.User, domain.ServerInstance, error) {
	user, err := svc.GetCurrentUser(sessionID)
	if err != nil {
		return domain.User{}, domain.ServerInstance{}, err
	}
	instance, err := svc.store.ServerInstances().Get(serverInstanceID)
	if err != nil {
		return domain.User{}, domain.ServerInstance{}, err
	}
	if !isPlatformAdmin(user) && instance.OwnerUserID != user.ID {
		return domain.User{}, domain.ServerInstance{}, ErrForbidden
	}
	return user, instance, nil
}

func canAccessServer(user domain.User, instance domain.ServerInstance) bool {
	return isPlatformAdmin(user) || instance.OwnerUserID == user.ID || containsString(instance.AdminUserIDs, user.ID)
}

func isPlatformAdmin(user domain.User) bool {
	for _, role := range user.Roles {
		switch role {
		case "admin", "platform-admin", "platformadmin":
			return true
		}
	}
	return false
}

func containsString(values []string, target string) bool {
	for _, value := range values {
		if value == target {
			return true
		}
	}
	return false
}