package permissions

import (
	"encoding/json"
	"strings"
)

const (
	Dashboard     = "dashboard"
	Report        = "report"
	Calendar      = "calendar"
	Team          = "team"
	Analytics     = "analytics"
	Notifications = "notifications"
	Chat          = "chat"
)

// Keys exposed to admin UI (employees/org master remains superadmin-only on API).
var Keys = []string{
	Dashboard,
	Report,
	Calendar,
	Team,
	Analytics,
	Notifications,
	Chat,
}

func DefaultUser() map[string]bool {
	return map[string]bool{
		Dashboard:     true,
		Report:        true,
		Calendar:      true,
		Team:          true,
		Analytics:     true,
		Notifications: true,
		Chat:          true,
	}
}

func AllEnabled() map[string]bool {
	out := make(map[string]bool, len(Keys))
	for _, k := range Keys {
		out[k] = true
	}
	return out
}

// Normalize merges stored permissions with defaults; superadmin always gets all.
func Normalize(role string, stored []byte) map[string]bool {
	if strings.EqualFold(strings.TrimSpace(role), "superadmin") {
		return AllEnabled()
	}
	base := DefaultUser()
	if len(stored) == 0 {
		return base
	}
	var raw map[string]bool
	if err := json.Unmarshal(stored, &raw); err != nil || raw == nil {
		return base
	}
	out := make(map[string]bool, len(Keys))
	for _, k := range Keys {
		if v, ok := raw[k]; ok {
			out[k] = v
		} else {
			out[k] = base[k]
		}
	}
	return out
}

func Allowed(perms map[string]bool, key string) bool {
	if perms == nil {
		return false
	}
	return perms[key]
}

func ToJSON(perms map[string]bool) ([]byte, error) {
	if perms == nil {
		return nil, nil
	}
	trim := make(map[string]bool, len(Keys))
	for _, k := range Keys {
		trim[k] = perms[k]
	}
	return json.Marshal(trim)
}

func FromClientMap(role string, m map[string]bool) ([]byte, map[string]bool, error) {
	if strings.EqualFold(strings.TrimSpace(role), "superadmin") {
		p := AllEnabled()
		b, err := ToJSON(p)
		return b, p, err
	}
	n := Normalize(role, nil)
	for _, k := range Keys {
		if v, ok := m[k]; ok {
			n[k] = v
		}
	}
	b, err := ToJSON(n)
	return b, n, err
}