package service

import (
	"context"

	"github.com/Tencent/WeKnora/internal/accesspolicy"
	apperrors "github.com/Tencent/WeKnora/internal/errors"
	"github.com/Tencent/WeKnora/internal/im"
	"github.com/Tencent/WeKnora/internal/types"
)

func (s *sessionService) prepareQAAgentExecution(ctx context.Context, req *types.QARequest) (context.Context, error) {
	if req.CustomAgent == nil || s.customAgentService == nil {
		return ctx, nil
	}
	provider, ok := s.customAgentService.(interface {
		PrepareAgentExecutionContext(context.Context, string) (context.Context, error)
	})
	if !ok {
		return ctx, apperrors.NewForbiddenError("Agent 执行授权校验不可用，请稍后重试")
	}
	agent := req.CustomAgent
	executionCtx := ctx
	if req.SharedAgentReadOnly {
		if req.Session == nil || req.Session.TenantID == 0 || s.agentShareService == nil {
			return ctx, apperrors.NewForbiddenError("共享 Agent 已失效或无权使用")
		}
		// The request handler already selected the source workspace. Recheck
		// its organization share before granting that exact Agent execution.
		shared, err := s.agentShareService.GetSharedAgentForTenant(ctx, req.Session.TenantID, types.TenantRoleFromContext(ctx), agent.ID, agent.TenantID)
		if err != nil || shared == nil || shared.ID != agent.ID || shared.TenantID != agent.TenantID {
			return ctx, apperrors.NewForbiddenError("共享 Agent 已失效或无权使用")
		}
		executionCtx = accesspolicy.WithExecutionDependency(ctx, shared.TenantID, "agents", shared.ID, shared.CreatedBy)
	} else if im.IsVerifiedAgentExecution(ctx, agent) {
		executionCtx = accesspolicy.WithExecutionDependency(ctx, agent.TenantID, "agents", agent.ID, agent.CreatedBy)
	}
	prepared, err := provider.PrepareAgentExecutionContext(executionCtx, agent.ID)
	if err != nil {
		return ctx, err
	}
	current, err := s.customAgentService.GetAgentByID(prepared, agent.ID)
	if err != nil {
		return ctx, err
	}
	if current == nil || current.TenantID != agent.TenantID {
		return ctx, apperrors.NewForbiddenError("Agent 已删除或无权使用")
	}
	req.CustomAgent = current
	return prepared, nil
}