/**
 * GET  /_emdash/api/admin/policies — list policies with the roles holding them
 * POST /_emdash/api/admin/policies — create a policy
 */

import type { APIRoute } from "astro";

import { requirePerm } from "#api/authorize.js";
import { apiError, apiSuccess, handleError } from "#api/error.js";
import { isParseError, parseBody } from "#api/parse.js";
import { policyCreateBody } from "#api/schemas.js";
import { invalidateAuthzCache } from "#auth/authz.js";
import { entriesGrantedBy, pluginCatalogEntries } from "#auth/route-catalog.js";
import { AuthzRepository } from "#db/repositories/authz.js";

import { authzErrorResponse } from "../roles/index.js";

export const prerender = false;

export const GET: APIRoute = async ({ locals, url }) => {
	const { emdash, user } = locals;
	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
	const denied = requirePerm(user, "policies:read");
	if (denied) return denied;

	try {
		const items = await new AuthzRepository(emdash.db).listPolicies();
		// `?withRoutes=1` annotates each policy with the catalogue entries its
		// grants cover — what the Routes tab uses to show "granted by".
		const withRoutes = url.searchParams.get("withRoutes") === "1";
		return apiSuccess({
			items: withRoutes
				? items.map((p) => ({ ...p, routeIds: entriesGrantedBy(p.rules, pluginCatalogEntries(emdash.listPluginRoutes?.() ?? [])).map((e) => e.id) }))
				: items,
		});
	} catch (error) {
		return handleError(error, "Failed to list policies", "POLICY_LIST_ERROR");
	}
};

export const POST: APIRoute = async ({ request, locals }) => {
	const { emdash, user } = locals;
	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
	const denied = requirePerm(user, "policies:manage");
	if (denied) return denied;

	try {
		const body = await parseBody(request, policyCreateBody);
		if (isParseError(body)) return body;

		const item = await new AuthzRepository(emdash.db).createPolicy(body);
		invalidateAuthzCache();
		return apiSuccess({ item }, 201);
	} catch (error) {
		return (
			authzErrorResponse(error) ??
			handleError(error, "Failed to create policy", "POLICY_CREATE_ERROR")
		);
	}
};