use std::collections::HashSet;
use std::sync::{OnceLock, RwLock};



static SYSTEM_UID: OnceLock<i64> = OnceLock::new();
static SPACE_BOTS: OnceLock<RwLock<HashSet<i64>>> = OnceLock::new();

/// Register the platform system actor (AI bot) that MCP internal keys act as.
/// Once set, every authorization check treats this uid as the owner of every
/// space and repository. The account is a bot with login prohibited, so it can
/// only ever be reached through the internal MCP key path.
pub fn set_system_uid(uid: i64) {
    let _ = SYSTEM_UID.set(uid);
}

/// Register a per-space bot that just signed a scoped top-level credential.
/// Like [`set_system_uid`], registered bots pass every owner-level check; the
/// credential layer is responsible for binding them to a single space (MCP
/// tool dispatch and the Git HTTP auth entry points both enforce the bind).
/// Space bots have no password, no sessions and no access keys, so this uid
/// can only be reached with the token that registered it.
pub fn register_space_bot(uid: i64) {
    let bots = SPACE_BOTS.get_or_init(|| RwLock::new(HashSet::new()));
    if let Ok(mut bots) = bots.write() {
        bots.insert(uid);
    }
}

pub fn system_uid() -> Option<i64> {
    SYSTEM_UID.get().copied()
}

pub fn is_system_uid(uid: i64) -> bool {
    if SYSTEM_UID.get().is_some_and(|value| *value == uid) {
        return true;
    }
    SPACE_BOTS
        .get()
        .and_then(|bots| bots.read().ok().map(|bots| bots.contains(&uid)))
        .unwrap_or(false)
}