/* eslint-disable @typescript-eslint/camelcase */
import { VersionedPermissionsConfig, SchemaPermissionEntry, FunctionPermissionEntry } from '@bmd-studio/genstack-pg';
import environment from '@bmd-studio/genstack-environment';

const {
  POSTGRES_DEFAULT_SCHEMA_NAME,
  POSTGRES_PUBLIC_SCHEMA_NAME,
  POSTGRES_HIDDEN_SCHEMA_NAME,
  POSTGRES_PRIVATE_SCHEMA_NAME,

  POSTGRES_ADMIN_ROLE_NAME,
  POSTGRES_ADMIN_SECRET,

  POSTGRES_ANONYMOUS_ROLE_NAME,
  POSTGRES_ANONYMOUS_SECRET,
  
  POSTGRES_IDENTITY_ROLE_NAME,
  POSTGRES_IDENTITY_SECRET,
} = environment.env;

const currentIdentityIdExpression = { 
  $expression: `current_identity_id()::uuid`, 
};
const publicExecutePermissions: FunctionPermissionEntry = {
  roles: ['public'],
  operations: ['execute'],
};
const publicUsagePermissions: SchemaPermissionEntry = {
  roles: ['public'],
  operations: ['usage'],
};

const permissionsConfig: VersionedPermissionsConfig = {
  version: 1,
  config: {
    roles: [{
      name: POSTGRES_ADMIN_ROLE_NAME,
      secret: POSTGRES_ADMIN_SECRET,
    },{
      name: POSTGRES_ANONYMOUS_ROLE_NAME,
      secret: POSTGRES_ANONYMOUS_SECRET,
    },{
      name: POSTGRES_IDENTITY_ROLE_NAME,
      secret: POSTGRES_IDENTITY_SECRET,
    },{
      name: 'manager',
    }],
    schemas: [{
      name: POSTGRES_DEFAULT_SCHEMA_NAME,
      permissions: [publicUsagePermissions],
      functions: [{
        name: 'uuid_generate_v4',
        permissions: [publicExecutePermissions],
      }],
    },{
      name: POSTGRES_HIDDEN_SCHEMA_NAME,
      permissions: [publicUsagePermissions],
    },{
      name: POSTGRES_PRIVATE_SCHEMA_NAME,
      permissions: [publicUsagePermissions],
    },{
      name: POSTGRES_PUBLIC_SCHEMA_NAME,
      permissions: [publicUsagePermissions],
      tables: [{
        name: 'identities',
        permissions: [{
          roles: ['manager'],
          columns: ['*'],
          operations: ['*'],
        }, {
          roles: [POSTGRES_IDENTITY_ROLE_NAME],
          columns: ['name', 'username'],
          operations: ['select', 'insert', 'update'],
          where: {
            id: currentIdentityIdExpression,
          },
        }],  
      }, {
        name: 'projects',
        permissions: [{
          roles: [POSTGRES_IDENTITY_ROLE_NAME],
          columns: ['id', 'name'],
          operations: ['select', 'insert', 'update'],          
          where: {
            $relation: {
              column: 'id',
              get: 'projects',
              by: 'current_identity',
            },
          },
        }],
      }, {
        name: 'project_permissions',
        permissions: [{
          roles: [POSTGRES_IDENTITY_ROLE_NAME],
          columns: ['*'],
          operations: ['*'],
          where: {
            identity_id: currentIdentityIdExpression,
          },          
        }],
      }],
      functions: [{
        name: 'current_identity_id',
        permissions: [publicExecutePermissions],
      },{
        name: 'current_identity_role',
        permissions: [publicExecutePermissions],
      }],      
    }],
  },
};

export default permissionsConfig;