<?php
/**
 * AdminPermission Model
 * Maps to `admin_permissions` table
 * Source of Truth: `admin_permissions` table (role_id, module, action)
 */

require_once __DIR__ . '/../Core/Model.php';

class AdminPermission extends Model {
    protected string $table = 'admin_permissions';

    /**
     * Default permission mapping sets per admin role (module.action)
     */
    public static array $roleDefaults = [
        'admin' => [
            'users.view', 'users.create', 'users.edit', 'users.delete', 'user.view', 'user.suspend',
            'stores.view', 'stores.approve', 'stores.reject', 'stores.suspend', 'seller.view', 'seller.approve', 'seller.suspend',
            'products.view', 'products.approve', 'products.reject', 'products.delete', 'product.view', 'product.approve', 'product.hide',
            'categories.view', 'categories.create', 'categories.edit', 'categories.delete', 'category.manage',
            'orders.view', 'orders.edit', 'order.view', 'order.investigate',
            'settlements.view', 'settlements.approve', 'commissions.view', 'commissions.edit', 'transactions.view', 'finance.view', 'finance.settle', 'settlement.manage',
            'reports.view', 'reports.resolve', 'report.manage',
            'settings.view', 'settings.edit', 'settings.manage',
            'permissions.view', 'permissions.edit', 'admin.manage',
            'activity_logs.view', 'announcement.manage', 'policy.manage',
            'dashboard.view', 'payment.verify', 'payment.refund', 'payment.manage_accounts',
        ],
        'operation_admin' => [
            'users.view', 'users.create', 'users.edit', 'user.view', 'user.suspend',
            'stores.view', 'stores.approve', 'stores.reject', 'stores.suspend', 'seller.view', 'seller.approve', 'seller.suspend',
            'products.view', 'products.approve', 'products.reject', 'products.delete', 'product.view', 'product.approve', 'product.hide',
            'categories.view', 'categories.create', 'categories.edit', 'categories.delete', 'category.manage',
            'orders.view', 'orders.edit', 'order.view', 'order.investigate',
            'reports.view', 'reports.resolve', 'report.manage',
            'dashboard.view', 'announcement.manage', 'policy.manage',
        ],
        'finance_admin' => [
            'seller.view', 'stores.view',
            'order.view', 'orders.view',
            'finance.view', 'finance.settle', 'settlement.manage',
            'commissions.view', 'commissions.edit',
            'settlements.view', 'settlements.approve', 'settlements.complete',
            'transactions.view', 'payment.verify', 'payment.refund', 'payment.manage_accounts',
            'dashboard.view',
        ],
        'support_admin' => [
            'user.view', 'users.view',
            'seller.view', 'stores.view',
            'product.view', 'product.hide', 'products.view',
            'order.view', 'order.investigate', 'orders.view',
            'reports.view', 'reports.resolve', 'report.manage',
            'dashboard.view',
        ],
    ];

    /**
     * Get all permissions assigned to roles from database
     */
    public function getPermissionsForRoles(array $roleNames): array {
        if (empty($roleNames)) {
            return [];
        }

        $placeholders = implode(',', array_fill(0, count($roleNames), '?'));
        $sql = "SELECT r.name AS role_name, ap.module, ap.action 
                FROM `admin_permissions` ap
                JOIN `roles` r ON ap.role_id = r.id
                WHERE r.name IN ($placeholders)";

        $rows = $this->fetchAll($sql, array_values($roleNames));
        $perms = [];

        foreach ($rows as $row) {
            $key = $row['module'] . '.' . $row['action'];
            $perms[$key] = true;

            // Also register mapped alias keys for compatibility
            $alias = $this->normalizePermissionKey($row['module'], $row['action']);
            if ($alias) {
                $perms[$alias] = true;
            }
        }

        return $perms;
    }

    /**
     * Normalize module.action to standard architecture key aliases
     */
    private function normalizePermissionKey(string $module, string $action): ?string {
        $map = [
            'users.view'          => 'user.view',
            'users.edit'          => 'user.suspend',
            'stores.view'         => 'seller.view',
            'stores.approve'      => 'seller.approve',
            'stores.suspend'      => 'seller.suspend',
            'products.view'       => 'product.view',
            'products.approve'    => 'product.approve',
            'products.reject'     => 'product.hide',
            'categories.view'     => 'category.manage',
            'categories.create'   => 'category.manage',
            'categories.edit'     => 'category.manage',
            'orders.view'         => 'order.view',
            'orders.edit'         => 'order.investigate',
            'reports.view'        => 'report.manage',
            'reports.resolve'     => 'report.manage',
            'settings.view'       => 'settings.manage',
            'settings.edit'       => 'settings.manage',
            'permissions.view'    => 'admin.manage',
            'permissions.edit'    => 'admin.manage',
            'commissions.view'    => 'finance.view',
            'settlements.view'    => 'finance.view',
            'settlements.approve' => 'finance.settle',
        ];

        return $map["{$module}.{$action}"] ?? null;
    }

    /**
     * Get per-user overrides if table exists, otherwise return empty array
     */
    public function getForAdmin(int $adminUserId): array {
        return [];
    }

    /**
     * Set per-user permission override placeholder
     */
    public function setPermission(int $adminUserId, string $key, bool $granted, int $grantedBy): void {
        // No-op or role-based mapping
    }

    /**
     * Remove permission override placeholder
     */
    public function removePermission(int $adminUserId, string $key): void {
        // No-op
    }
}