package accesspolicy

import (
	"context"

	"github.com/Tencent/WeKnora/internal/types"
)

type executionDependencyKey struct{}

type executionDependency struct {
	tenant uint64
	owner  string
}

// WithExecutionDependency is only for server-verified bindings of an authorized
// resource. It never changes publication, list visibility, or write ownership.
func WithExecutionDependency(ctx context.Context, tenant uint64, kind, id, owner string) context.Context {
	bindings := map[string]executionDependency{}
	if previous, ok := ctx.Value(executionDependencyKey{}).(map[string]executionDependency); ok {
		for key, binding := range previous {
			bindings[key] = binding
		}
	}
	if tenant != 0 && id != "" && owner != "" {
		bindings[kind+":"+id] = executionDependency{tenant, owner}
	}
	return context.WithValue(ctx, executionDependencyKey{}, bindings)
}

func CanExecuteDependency(ctx context.Context, tenant uint64, kind, id, owner string) bool {
	current, ok := types.TenantIDFromContext(ctx)
	if !ok || tenant == 0 || tenant != current || owner == "" || Hidden(ctx, kind, id) {
		return false
	}
	module := kind
	if module == "skills" {
		module = "agents"
	}
	if !Allowed(ctx, module+".read") {
		return false
	}
	bindings, _ := ctx.Value(executionDependencyKey{}).(map[string]executionDependency)
	return bindings[kind+":"+id] == (executionDependency{tenant, owner})
}