package console

import (
	"context"
	"time"

	"github.com/carlosframework/platform/internal/release"
	"github.com/carlosframework/platform/internal/telemetry"
)

// The helpers in this file are the ordinary route writers' mutation guard.
// Each is called after the handler's own authentication, authorization and
// validation, and wraps exactly the write that follows them. With HostClaim
// off the raw deployment bucket implements no release.AppMutationRunner and
// the SQL store has no gate, so every helper runs its callback unchanged.

// appMutation runs one validated app write as an app mutation of acct/app on
// the installed deployment boundary. The callback must use the context it is
// handed: that context carries the permit every bucket, SQL and backend
// write below it is checked against. A caller that already holds a permitted
// context for the same app joins it rather than opening a second operation.
func (s *Server) appMutation(ctx context.Context, acct *Account, app, action string, fn func(context.Context) error) error {
	return release.WithAppMutation(ctx, s.cfg.Releases, acct.Sqid, app, action, fn)
}

// updateAppTelemetry is telemetry.Update of the app's own settings object as
// one app mutation. The account-wide default (telemetry.AccountKey) names no
// app and stays a plain write.
func (s *Server) updateAppTelemetry(ctx context.Context, acct *Account, app, action string, fn func(*telemetry.Settings)) error {
	return s.appMutation(ctx, acct, app, action, func(ctx context.Context) error {
		return telemetry.Update(ctx, s.cfg.Releases, telemetry.AppKey(acct.Sqid, app), fn)
	})
}

// ConfirmChangeContext is ConfirmChange as a write of the change's own app.
// The caller has already proved the change belongs to accountID/app
// (pendingScoped); the armed gate refuses the write if it does not.
func (s *Store) ConfirmChangeContext(ctx context.Context, accountID int64, app, id, address string, now time.Time) (pc *PendingChange, met bool, err error) {
	err = s.withAutoAppSQL(ctx, accountID, app, "sql.ConfirmChange", func(v *Store) error {
		pc, met, err = v.ConfirmChange(id, address, now)
		return err
	})
	return pc, met, err
}

// MarkExecutedContext is MarkExecuted as a write of the change's own app.
func (s *Store) MarkExecutedContext(ctx context.Context, accountID int64, app, id string, now time.Time) error {
	return s.withAutoAppSQL(ctx, accountID, app, "sql.MarkExecuted", func(v *Store) error {
		return v.MarkExecuted(id, now)
	})
}

// DeleteChangeContext is DeleteChange as a write of the change's own app.
func (s *Store) DeleteChangeContext(ctx context.Context, accountID int64, app, id string) error {
	return s.withAutoAppSQL(ctx, accountID, app, "sql.DeleteChange", func(v *Store) error {
		return v.DeleteChange(id)
	})
}

// serviceCredentialWrite runs one rotate or revoke of the account's service
// credential h. A credential scoped to an app is a row of that app and is
// written as its app mutation; an account-wide credential (empty app) names
// no app and is written directly, as the gate allows for cli_tokens rows with
// an empty app column.
// The scope is read from the credential before the write. A stale or failed
// read can only pick the wrong scope, and the armed gate then refuses the
// write rather than letting it land. Ungated, fn runs on the store as before
// and nothing extra is read.
func (s *Server) serviceCredentialWrite(ctx context.Context, acct *Account, h serviceHandle, action string, fn func(*Store) error) error {
	if s.store.gate == nil {
		return fn(s.store)
	}
	rows, err := s.store.ServicePrincipals(acct.ID)
	if err != nil {
		return err
	}
	for _, row := range rows {
		if (h.name != "" && row.Name == h.name) || (h.id != "" && row.ID == h.id) {
			return s.store.withAutoAppSQL(ctx, acct.ID, row.App, action, fn)
		}
	}
	return fn(s.store)
}