package main

import "strings"

const (
	permKeycloakThemesRead                   = "keycloak_themes.read"
	permKeycloakThemesCreate                 = "keycloak_themes.create"
	permKeycloakThemesEdit                   = "keycloak_themes.edit"
	permKeycloakThemesPublish                = "keycloak_themes.publish"
	permKeycloakThemesArchive                = "keycloak_themes.archive"
	permKeycloakThemesDeploy                 = "keycloak_themes.deploy"
	permKeycloakThemesPreview                = "keycloak_themes.preview"
	permKeycloakThemesPolicyManage           = "keycloak_themes.policy.manage"
	permKeycloakThemesManagePlatformDefaults = "keycloak_themes.manage_platform_defaults"
	permKeycloakThemesManageOrgOverrides     = "keycloak_themes.manage_org_overrides"
)

var keycloakThemePermissionRegistry = []string{
	permKeycloakThemesRead,
	permKeycloakThemesCreate,
	permKeycloakThemesEdit,
	permKeycloakThemesPublish,
	permKeycloakThemesArchive,
	permKeycloakThemesDeploy,
	permKeycloakThemesPreview,
	permKeycloakThemesPolicyManage,
	permKeycloakThemesManagePlatformDefaults,
	permKeycloakThemesManageOrgOverrides,
}

var rolePermissionRegistry = map[string][]string{
	"admin":                     {"*"},
	"platform_owner":            {"keycloak_themes.*"},
	"platform_admin":            keycloakThemePermissionRegistry,
	"platform_content_reviewer": {permKeycloakThemesRead, permKeycloakThemesPreview},
	"organisation_owner": {
		permKeycloakThemesRead,
		permKeycloakThemesEdit,
		permKeycloakThemesPreview,
		permKeycloakThemesManageOrgOverrides,
	},
	"organisation_admin": {
		permKeycloakThemesRead,
		permKeycloakThemesEdit,
		permKeycloakThemesPreview,
	},
}

func hasAnyRole(claims *accessClaims, roles ...string) bool {
	for _, role := range roles {
		if hasRole(claims, role) {
			return true
		}
	}
	return false
}

func hasPermission(claims *accessClaims, permission string) bool {
	if claims == nil {
		return false
	}

	for _, candidate := range claims.Permissions {
		if permissionMatch(candidate, permission) {
			return true
		}
	}

	for _, role := range claims.RealmAccess.Roles {
		grants, ok := rolePermissionRegistry[role]
		if !ok {
			continue
		}
		for _, grant := range grants {
			if permissionMatch(grant, permission) {
				return true
			}
		}
	}

	return false
}

func permissionMatch(grant, permission string) bool {
	if grant == "*" || grant == permission {
		return true
	}

	if strings.HasSuffix(grant, ".*") {
		prefix := strings.TrimSuffix(grant, "*")
		return strings.HasPrefix(permission, prefix)
	}

	return false
}