package common

import (
	"git.apinb.com/bsm-sdk/core/errcode"
	"git.apinb.com/bsm-sdk/core/infra"
	"git.apinb.com/bsm-sdk/core/middleware"
	"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
	"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
	"github.com/gin-gonic/gin"
)

// RequirePlatformRoot restricts sensitive platform configuration operations to the root role.
func RequirePlatformRoot(ctx *gin.Context) bool {
	claims, err := middleware.ParseAuth(ctx)
	if err == nil && claims.Role == "root" {
		return true
	}
	infra.Response.Error(ctx, errcode.ErrPermissionDenied)
	return false
}

// LoadPlatformMenus returns the menus granted to one platform role.
func LoadPlatformMenus(roleCode string) ([]models.PlatformMenu, error) {
	var menus []models.PlatformMenu
	if roleCode == "root" {
		err := impl.DBService.Order("sort_no asc, id asc").Find(&menus).Error
		return menus, err
	}

	var role models.PlatformRole
	if err := impl.DBService.Where("role_code = ? AND status = ?", roleCode, "enabled").First(&role).Error; err != nil {
		return nil, err
	}
	err := impl.DBService.
		Select("platform_menu.*").
		Joins("JOIN platform_role_menu ON platform_role_menu.platform_menu_id = platform_menu.id").
		Where("platform_role_menu.platform_role_id = ? AND platform_menu.status = ?", role.ID, "enabled").
		Order("sort_no asc, id asc").
		Find(&menus).Error
	return menus, err
}