package rolepolicy

import (
	"context"
	"slices"

	"github.com/gogf/gf/v2/errors/gerror"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/consts"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/dao"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/library/contexts"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/model/entity"
)

// ValidateUserRoleAssignment prevents local operators from obtaining platform-only
// permissions by binding a more privileged role instead of editing its menus.
// Existing bindings may be retained when editing unrelated user information.
func ValidateUserRoleAssignment(ctx context.Context, tenantID string, deptID int64, requested, existing []int64) error {
	if contexts.IsSuperAdmin(ctx) {
		return nil
	}
	template, err := Template(ctx)
	if err != nil {
		return err
	}
	if template == nil || tenantID != template.TenantId {
		return nil
	}
	if contexts.GetTenantId(ctx) != tenantID {
		return gerror.New("不能跨租户分配角色")
	}
	for _, roleID := range requested {
		if roleID == consts.SuperAdminRoleId {
			return gerror.New("不能分配平台超级管理员角色")
		}
		if slices.Contains(existing, roleID) {
			continue
		}
		var role *entity.SysRole
		if err := dao.SysRole.Ctx(ctx).Master().Where("tenant_id", tenantID).Where("dept_id", deptID).Where("role_id", roleID).Where("status", "0").Scan(&role); err != nil {
			return err
		}
		if role == nil {
			return gerror.Newf("角色%d不存在、已停用或不属于用户所在机构", roleID)
		}
		menus, err := MenuIDs(ctx, roleID)
		if err != nil {
			return err
		}
		if _, err := NormalizeAssignableMenus(ctx, tenantID, contexts.GetDeptId(ctx), contexts.GetUserId(ctx), menus); err != nil {
			return gerror.Wrapf(err, "角色%d包含超出当前账号可分配范围的权限，请联系平台管理员绑定", roleID)
		}
	}
	return nil
}