/**
 * Field permission rules query helpers — field-level-permissions (wave-11 leaf-E).
 */
import { eq } from 'drizzle-orm'
import type { Db } from '../client'
import { fieldPermissionRules } from '../schema/field-permission-rules'
import { auditLog } from './_audit-forward'

export type { FieldPermissionRuleRow } from '../schema/field-permission-rules'

// ── getTenantFieldRules ────────────────────────────────────────────────────────

export async function getTenantFieldRules(
  db: Db,
  tenantId: string,
): Promise<Array<{ entityType: string; fieldName: string; role: string; permission: string }>> {
  const rows = await db
    .select({
      entityType: fieldPermissionRules.entityType,
      fieldName: fieldPermissionRules.fieldName,
      role: fieldPermissionRules.role,
      permission: fieldPermissionRules.permission,
    })
    .from(fieldPermissionRules)
    .where(eq(fieldPermissionRules.tenantId, tenantId))

  return rows
}

// ── saveTenantFieldRules ───────────────────────────────────────────────────────

export async function saveTenantFieldRules(
  db: Db,
  tenantId: string,
  actorId: string,
  rules: Array<{ entity_type: string; field_name: string; role: string; permission: string }>,
): Promise<void> {
  const persistedRules = rules.filter((rule) => rule.permission !== 'visible')

  await db.transaction(async (tx) => {
    // Clear existing rules for tenant
    await tx
      .delete(fieldPermissionRules)
      .where(eq(fieldPermissionRules.tenantId, tenantId))

    if (persistedRules.length > 0) {
      await tx.insert(fieldPermissionRules).values(
        persistedRules.map((r) => ({
          tenantId,
          entityType: r.entity_type,
          fieldName: r.field_name,
          role: r.role,
          permission: r.permission,
        })),
      )
    }

    await tx.insert(auditLog).values({
      tenantId,
      actorId,
      actorType: 'user',
      entityType: 'field_permission_rules',
      entityId: tenantId,
      action: 'field_permission_rules.saved',
    })
  })
}