import { isOwnerRole } from './system-roles'

export type TeamGuardFailure = { ok: false; status: 400 | 403 | 404; error: string }
export type TeamGuardSuccess = { ok: true }
export type TeamGuardResult = TeamGuardFailure | TeamGuardSuccess

export function guardDeleteTeamMember(input: {
  actorUserId: string
  targetUserId: string
  targetMember: { role: string } | undefined
}): TeamGuardResult {
  if (input.targetUserId === input.actorUserId) {
    return { ok: false, status: 400, error: 'Cannot remove yourself' }
  }
  if (!input.targetMember) {
    return { ok: false, status: 404, error: 'Member not found' }
  }
  if (isOwnerRole(input.targetMember.role)) {
    return { ok: false, status: 400, error: 'Cannot remove the owner' }
  }
  return { ok: true }
}

export function guardPatchTeamMemberRole(input: {
  targetMember: { role: string } | undefined
  newRoleName: string
}): TeamGuardResult {
  if (!input.targetMember) {
    return { ok: false, status: 404, error: 'Member not found' }
  }
  if (isOwnerRole(input.targetMember.role)) {
    return { ok: false, status: 403, error: "Cannot change owner's role; use /team/transfer" }
  }
  if (isOwnerRole(input.newRoleName)) {
    return { ok: false, status: 403, error: 'Use /team/transfer to grant ownership' }
  }
  return { ok: true }
}