/**
 * Field permissions effective map route — field-level-permissions (wave-11 leaf-E).
 * Mounted at /api/field-permissions/effective.
 *
 * GET / → effective field permission map for current user's role.
 * Returns only non-visible entries: { [entityType]: { [fieldName]: 'read_only' | 'hidden' } }
 */
import { Hono } from 'hono'
import type { AppEnv } from '../../types'
import { authMiddleware } from '../../middleware/auth'
import { getTenantFieldRules } from '@zync/db/queries'

type FieldPermission = 'visible' | 'read_only' | 'hidden'
type EffectiveMap = Record<string, Record<string, FieldPermission>>

function buildEffectiveMap(
  rules: Array<{ entityType: string; fieldName: string; role: string; permission: string }>,
  role: string,
): EffectiveMap {
  const map: EffectiveMap = {}
  for (const rule of rules) {
    if (rule.role !== role) continue
    if (rule.permission === 'visible') continue
    ;(map[rule.entityType] ??= {})[rule.fieldName] = rule.permission as FieldPermission
  }
  return map
}

export const fieldPermissionsEffectiveRoute = new Hono<AppEnv>()

fieldPermissionsEffectiveRoute.use('*', authMiddleware)

fieldPermissionsEffectiveRoute.get('/', async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const db = c.get('db')
  const rules = await getTenantFieldRules(db, session.tid)
  const effective = buildEffectiveMap(rules, session.role ?? '')
  return c.json(effective, 200)
})