using Nuuru.Server.Auth;
using Nuuru.Server.Extensions;

namespace Nuuru.Server.Services
{
    /// <summary>
    /// Provides access to the current user's identity and permissions.
    /// Scoped per-request, allows services to check user context without parameter drilling.
    /// </summary>
    public interface ICurrentUserContext
    {
        /// <summary>
        /// The current user's ID, or null if not authenticated.
        /// </summary>
        Guid? UserId { get; }

        /// <summary>
        /// Whether there is an authenticated user.
        /// </summary>
        bool IsAuthenticated { get; }

        /// <summary>
        /// Check if the current user has a specific permission.
        /// Returns false if not authenticated.
        /// </summary>
        bool HasPermission(string permission);
    }

    /// <summary>
    /// HTTP implementation that reads from HttpContext.User.
    /// </summary>
    public class HttpCurrentUserContext : ICurrentUserContext
    {
        private readonly IHttpContextAccessor _httpContextAccessor;
        private Guid? _cachedUserId;
        private bool _userIdCached;

        public HttpCurrentUserContext(IHttpContextAccessor httpContextAccessor)
        {
            _httpContextAccessor = httpContextAccessor;
        }

        public Guid? UserId
        {
            get
            {
                if (!_userIdCached)
                {
                    _cachedUserId = _httpContextAccessor.HttpContext?.User?.GetUserId();
                    _userIdCached = true;
                }
                return _cachedUserId;
            }
        }

        public bool IsAuthenticated => _httpContextAccessor.HttpContext?.User?.Identity?.IsAuthenticated ?? false;

        public bool HasPermission(string permission)
        {
            return _httpContextAccessor.HttpContext?.User?.HasPermission(permission) ?? false;
        }
    }

    /// <summary>
    /// System context for background jobs or non-HTTP scenarios.
    /// Defaults to no user with no permissions.
    /// </summary>
    public class AnonymousUserContext : ICurrentUserContext
    {
        public Guid? UserId => null;
        public bool IsAuthenticated => false;
        public bool HasPermission(string permission) => false;
    }

    /// <summary>
    /// System context with elevated permissions for background jobs.
    /// </summary>
    public class SystemUserContext : ICurrentUserContext
    {
        public Guid? UserId => null;
        public bool IsAuthenticated => false;
        public bool HasPermission(string permission) => true; // System has all permissions
    }
}