import { api, ApiError, failureMessage } from "$lib/api";
import type { MeResponse, StaffAccess } from "$lib/types";

export type AdminGateResult =
	| { ok: true; me: MeResponse; staff: StaffAccess }
	| { ok: false; reason: "auth" | "forbidden" | "error"; message: string };

function resolveStaff(me: MeResponse): StaffAccess {
	if (me.staff_access) {
		return {
			staff_role: me.staff_access.staff_role,
			full_admin: Boolean(me.staff_access.full_admin),
			support_desk: Boolean(me.staff_access.support_desk),
			is_support_only: Boolean(me.staff_access.is_support_only)
		};
	}
	// Legacy fallback when staff_access is absent (pre-migration clients).
	const full = Boolean(me.user?.is_platform_admin);
	return {
		full_admin: full,
		support_desk: full,
		is_support_only: false
	};
}

export async function requirePlatformAdmin(): Promise<AdminGateResult> {
	try {
		const me = await api<MeResponse>("/api/auth/me");
		const staff = resolveStaff(me);
		if (!staff.full_admin) {
			return { ok: false, reason: "forbidden", message: "Platform admin required." };
		}
		return { ok: true, me, staff };
	} catch (err) {
		if (err instanceof ApiError && err.status === 401) {
			return { ok: false, reason: "auth", message: "Authentication required." };
		}
		if (err instanceof ApiError && err.status === 403) {
			return { ok: false, reason: "forbidden", message: "Platform admin required." };
		}
		return {
			ok: false,
			reason: "error",
			message: failureMessage(err, "Failed to verify admin access")
		};
	}
}

/** Full admin or support_staff — for /admin/support desk pages. */
export async function requireSupportDesk(): Promise<AdminGateResult> {
	try {
		const me = await api<MeResponse>("/api/auth/me");
		const staff = resolveStaff(me);
		if (!staff.support_desk) {
			return { ok: false, reason: "forbidden", message: "Support desk access required." };
		}
		return { ok: true, me, staff };
	} catch (err) {
		if (err instanceof ApiError && err.status === 401) {
			return { ok: false, reason: "auth", message: "Authentication required." };
		}
		if (err instanceof ApiError && err.status === 403) {
			return { ok: false, reason: "forbidden", message: "Support desk access required." };
		}
		return {
			ok: false,
			reason: "error",
			message: failureMessage(err, "Failed to verify support access")
		};
	}
}