package middleware

import (
	"github.com/Tencent/WeKnora/internal/accesspolicy"
	apperrors "github.com/Tencent/WeKnora/internal/errors"
	"github.com/Tencent/WeKnora/internal/types"
	"github.com/gin-gonic/gin"
)

// RequireKnowledgeExport runs after RequireKBAccess. Published and granted
// resources are read/use only; API keys retain their route and KB scopes.
func RequireKnowledgeExport() gin.HandlerFunc {
	return func(c *gin.Context) {
		ctx := c.Request.Context()
		if _, apiKey := types.TenantAPIKeyScopeFromContext(ctx); apiKey {
			c.Next()
			return
		}
		if types.IsSystemAdminFromContext(ctx) || types.TenantRoleFromContext(ctx).HasPermission(types.TenantRoleAdmin) {
			c.Next()
			return
		}
		snapshot := accesspolicy.FromContext(ctx)
		if snapshot == nil {
			c.Next()
			return
		}
		access, ok := KBAccessFromContext(c)
		if !ok || access == nil || access.KnowledgeBase == nil {
			_ = c.Error(apperrors.NewServiceUnavailableError("cannot verify knowledge export permission"))
			c.Abort()
			return
		}
		if snapshot.Publications["knowledge:"+access.KnowledgeBase.ID] || snapshot.NoExport["knowledge:"+access.KnowledgeBase.ID] {
			_ = c.Error(apperrors.NewForbiddenError("全局知识库仅支持查看和使用，普通用户不能导出"))
			c.Abort()
			return
		}
		userID, _ := types.UserIDFromContext(ctx)
		if userID == "" || access.KnowledgeBase.CreatorID == "" || access.KnowledgeBase.CreatorID != userID {
			_ = c.Error(apperrors.NewForbiddenError("授权知识库仅支持查看和使用，非所有者不能导出"))
			c.Abort()
			return
		}
		c.Next()
	}
}