//! 内部 RPC 的 space 域：把资源 id 解析到目录后复用权限内核（Access/Capability）。

use internal::Gate;
use internal::server::InternalRouter;
use proto::internal::v1::issue_authorization_service_server::{
    IssueAuthorizationService as IssueAuthorizationTrait, IssueAuthorizationServiceServer,
};
use proto::internal::v1::pull_authorization_service_server::{
    PullAuthorizationService as PullAuthorizationTrait, PullAuthorizationServiceServer,
};
use proto::internal::v1::space_authorization_service_server::{
    SpaceAuthorizationService as SpaceAuthorizationTrait, SpaceAuthorizationServiceServer,
};
use proto::internal::v1::{
    AuthorizationDecision, AuthorizeIssueRequest, AuthorizePullRequest, AuthorizeResourceRequest,
    SpaceMembersRequest, SpaceMembersResponse,
};
use tonic::{Request, Response, Status};

use crate::errors::SpaceError;
use crate::services::service::SpaceService;

mod space_directory;

pub fn register(router: InternalRouter, service: &SpaceService, gate: Gate) -> InternalRouter {
    let rpc = SpaceRpc {
        service: service.clone(),
    };
    let router = space_directory::register(router, service, gate.clone());
    let router = router.add_service(IssueAuthorizationServiceServer::with_interceptor(
        rpc.clone(),
        gate.clone(),
    ));
    let router = router.add_service(PullAuthorizationServiceServer::with_interceptor(
        rpc.clone(),
        gate.clone(),
    ));
    let router = router.add_service(SpaceAuthorizationServiceServer::with_interceptor(
        rpc.clone(),
        gate.clone(),
    ));
    router
}

#[derive(Clone)]
struct SpaceRpc {
    service: SpaceService,
}

fn resource_id(value: &str) -> Result<uuid::Uuid, Status> {
    value
        .parse()
        .map_err(|_| Status::invalid_argument("resource id must be a UUID"))
}

#[tonic::async_trait]
impl IssueAuthorizationTrait for SpaceRpc {
    async fn authorize_issue(
        &self,
        request: Request<AuthorizeIssueRequest>,
    ) -> Result<Response<AuthorizationDecision>, Status> {
        let _meta = internal::interceptor::meta(&request)?;
        let request = request.into_inner();
        let issue_id = resource_id(&request.issue_id)?;
        let allowed = self
            .service
            .authorize_internal_issue(request.user_id, issue_id)
            .await
            .map_err(status_of)?;
        Ok(Response::new(AuthorizationDecision {
            allowed,
            reason: String::new(),
            resource_id: request.issue_id,
        }))
    }
}

#[tonic::async_trait]
impl PullAuthorizationTrait for SpaceRpc {
    async fn authorize_pull(
        &self,
        request: Request<AuthorizePullRequest>,
    ) -> Result<Response<AuthorizationDecision>, Status> {
        let _meta = internal::interceptor::meta(&request)?;
        let request = request.into_inner();
        let pull_id = resource_id(&request.pull_id)?;
        let allowed = self
            .service
            .authorize_internal_pull(request.user_id, pull_id)
            .await
            .map_err(status_of)?;
        Ok(Response::new(AuthorizationDecision {
            allowed,
            reason: String::new(),
            resource_id: request.pull_id,
        }))
    }
}

#[tonic::async_trait]
impl SpaceAuthorizationTrait for SpaceRpc {
    async fn authorize_repo(
        &self,
        request: Request<AuthorizeResourceRequest>,
    ) -> Result<Response<AuthorizationDecision>, Status> {
        let _meta = internal::interceptor::meta(&request)?;
        let request = request.into_inner();
        let repo_id = resource_id(&request.repo_id)?;
        let allowed = self
            .service
            .authorize_internal_repo(request.user_id, repo_id)
            .await
            .map_err(status_of)?;
        Ok(Response::new(AuthorizationDecision {
            allowed,
            reason: String::new(),
            resource_id: request.repo_id,
        }))
    }

    async fn authorize_space(
        &self,
        request: Request<AuthorizeResourceRequest>,
    ) -> Result<Response<AuthorizationDecision>, Status> {
        let _meta = internal::interceptor::meta(&request)?;
        let request = request.into_inner();
        let space_id = resource_id(&request.space_id)?;
        let allowed = self
            .service
            .authorize_internal_space(request.user_id, space_id)
            .await
            .map_err(status_of)?;
        Ok(Response::new(AuthorizationDecision {
            allowed,
            reason: String::new(),
            resource_id: request.space_id,
        }))
    }

    async fn list_members(
        &self,
        request: Request<SpaceMembersRequest>,
    ) -> Result<Response<SpaceMembersResponse>, Status> {
        let _meta = internal::interceptor::meta(&request)?;
        let request = request.into_inner();
        let space_id = resource_id(&request.space_id)?;
        let user_ids = self
            .service
            .internal_space_member_ids(space_id)
            .await
            .map_err(status_of)?;
        Ok(Response::new(SpaceMembersResponse { user_ids }))
    }
}

fn status_of(error: SpaceError) -> Status {
    match error {
        SpaceError::Unauthorized => Status::unauthenticated("space authorization rejected"),
        SpaceError::Forbidden | SpaceError::NotFound | SpaceError::SpaceNotFound => {
            Status::permission_denied("not allowed")
        }
        SpaceError::BadRequest(message) => Status::invalid_argument(message),
        other => {
            tracing::warn!(%other, "internal space authorization failed");
            Status::internal("space authorization failed")
        }
    }
}