// Copyright Abridged, Inc. 2021,2024. All Rights Reserved.
// Node module: @collabland/api-security
// This file is licensed under the MIT License.
// License text available at https://opensource.org/licenses/MIT

/**
 * Built-in roles
 */
export enum AuthorizationRoles {
  /**
   * CollabLand administrator (whitelisted users)
   */
  ADMIN = '$admin',

  /**
   * CollabLand customer support
   */
  CUSTOMER_SUPPORT = '$customer_support',

  /**
   * CollabLand client application/service account
   */
  SERVICE_ACCOUNT = '$service_account',

  /**
   * CollabLand users
   */
  USER_ACCOUNT = '$user_account',

  /**
   * Owner of the target entity
   */
  OWNER = '$owner',

  /**
   * Community administrator
   */
  COMMUNITY_ADMIN = '$community_admin',

  /**
   * Anonymous user
   */
  ANONYMOUS = '$anonymous',

  /**
   * Authenticated user
   */
  AUTHENTICATED = '$authenticated',
}

/**
 * Check if a given role is a user role
 * @param role - Role name
 * @returns
 */
export function isUserRole(role: string) {
  return [
    AuthorizationRoles.ADMIN,
    AuthorizationRoles.COMMUNITY_ADMIN,
    AuthorizationRoles.CUSTOMER_SUPPORT,
    AuthorizationRoles.OWNER,
    AuthorizationRoles.USER_ACCOUNT,
  ].some(r => r === role);
}

export enum InternalScopes {
  PUBLIC = '$public', // skip scope checking
  INTERNAL = '$internal', // for client apps owned by Collab.Land only
  ALL = '$all', // allow all
}

export const OAUTH2_DEFAULT_SCOPE = ''; // 'identify profile';

/**
 * Mapping from scope id to human-readable description
 */
export const SCOPE_DESCRIPTIONS: Record<string, string | string[]> = {
  'user:wallet:read': `Read wallets that you have connected with Collab.Land`,
  'user:wallet:write': `Add a new wallet or remove an existing wallet for you`,
  'user:pkp:claim': 'Claim your gmPASS (PKP) on behalf of you',
  'user:pkp:read': 'Read your gmPASS (PKP)',
  'user:pkp:sign': 'Sign a message or transaction with your gmPASS (PKP)',
  $public: 'Publicly accessible API endpoints',
  'user:community:read': 'Read your communities',
  'user:read': 'Read your basic profile',
  $internal: 'Internal API endpoints',
  'community:read': 'See communities you are in and administrating',
  'community:write': 'Update community information',
  'log-settings': 'Read or update log settings',
  'discord:guild': 'Call Discord guild APIs',

  /*
  'discord-integration:read-tgr-info': ['CommunityController.getGuildTGRInfo'],
  'discord-integration:read-guild-member-info': [
    'DiscordIntegrationController.getMemberInfo',
  ],
  'discord-integration:read-guild-role': [
    'DiscordIntegrationController.getGuildRoles',
  ],
  'discord-integration:read-guild-members': [
    'DiscordIntegrationController.getGuildActiveMembers',
    'DiscordIntegrationController.getGuildMembers',
  ],
  'discord-integration:send-channel-message': [
    'DiscordIntegrationController.sendDiscordMessage',
  ],
  */
  'discord:message': 'Send messages to a Discord channel',
  'discord:user': 'Call Discord guild member APIs',
  'token-gating': 'Invoke token gating service',
  'verifiable-credential:read':
    'Read certain type public verifiable credentials issued to you',
  'user:verifiable-credential:read':
    'Read all public verifiable credentials issued to you',
  'verifiable-credential:write': 'Issue you public verifiable credentials',
  'user:verifiable-credential:write':
    'Issue you Discord role verifiable credentials',
  'user:webauthn-credential:read': 'Read your webauthn/passkey credentials',
  'user:webauthn-credential:write':
    'Update or delete your webauthn/passkey credentials',
};

/**
 * Mapping from scope alias to scope id
 */
export const SCOPE_ALIASES: Record<string, string> = {
  'discord-integration:read-tgr-info': 'discord:guild',
  'discord-integration:read-guild-member-info': 'discord:user',
  'discord-integration:read-guild-role': 'discord:guild',
  'discord-integration:read-guild-members': 'discord:guild',
  'discord-integration:send-channel-message': 'discord:message',
};

export function normalizeScopes(scopes: string[]) {
  return scopes
    .map(s => s.trim())
    .filter(s => !!s)
    .map(s => SCOPE_ALIASES[s] ?? s);
}