package server

import (
	"net/http"

	"kra/internal/biz"
	"kra/internal/service"

	"github.com/gin-gonic/gin"
)

func registerAccessRoutes(group *gin.RouterGroup, engine *gin.Engine, svc *service.AccessService) {
	registerAuthorityRoutes(group, svc)
	registerMenuRoutes(group, svc)
	registerAPIRoutes(group, engine, svc)
	registerPolicyRoutes(group, svc)
	registerDepartmentRoutes(group, svc)
	registerPositionRoutes(group, svc)
}

func accessControl(svc *service.AccessService, audit *service.AuditService) gin.HandlerFunc {
	return func(c *gin.Context) {
		claims := currentClaims(c)
		if claims == nil {
			noAuth(c, "未登录或非法访问")
			return
		}
		path := c.Request.URL.Path
		allowed, err := svc.Authorize(c.Request.Context(), claims.AuthorityID, path, c.Request.Method)
		if err != nil || !allowed {
			requestID, _ := c.Get("request_id")
			_ = audit.RecordDataAccess(c.Request.Context(), &biz.DataAccessLog{EventType: "blocked_access", Operation: c.Request.Method, UserID: claims.ID, AuthorityID: claims.AuthorityID, RequestID: toString(requestID), Method: c.Request.Method, Path: c.Request.URL.Path, Detail: "Casbin policy denied the request"})
			c.AbortWithStatusJSON(http.StatusForbidden, response{Code: codeError, Data: nil, Msg: "权限不足"})
			return
		}
		scope, err := svc.ResolveDataScope(c.Request.Context(), claims.AuthorityID, claims.ID)
		if err != nil {
			fail(c, "数据权限加载失败")
			return
		}
		c.Request = c.Request.WithContext(biz.NewDataScopeContext(c.Request.Context(), scope))
		c.Next()
	}
}