use axum::{
    extract::{Query, State},
    http::StatusCode,
    response::IntoResponse,
    Extension, Json,
};
use serde::{Deserialize, Serialize};

use crate::{auth::jwt::Claims, config::AppState};

#[derive(Debug, Deserialize)]
pub struct CheckPermissionQuery {
    pub resource_type: String,
    pub resource_id: String,
    pub permission: String,
}

#[derive(Debug, Serialize)]
pub struct PermissionCheckResponse {
    pub has_permission: bool,
    pub resource_type: String,
    pub resource_id: String,
    pub permission: String,
}

pub async fn check_permission(
    State(state): State<AppState>,
    Query(params): Query<CheckPermissionQuery>,
    Extension(claims): Extension<Claims>,
) -> impl IntoResponse {
    let has_permission = match state
        .db
        .check_user_permission(
            &claims.sub,
            &params.resource_type,
            &params.resource_id,
            &params.permission,
        )
        .await
    {
        Ok(result) => result,
        Err(e) => {
            tracing::error!("Failed to check permission: {}", e);
            return (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(serde_json::json!({
                    "error": "failed to check permission"
                })),
            )
                .into_response();
        }
    };

    let response = PermissionCheckResponse {
        has_permission,
        resource_type: params.resource_type,
        resource_id: params.resource_id,
        permission: params.permission,
    };

    (StatusCode::OK, Json(response)).into_response()
}