import type { UserRole } from '../../auth.js';

export type RoutePermission = 'public' | 'machine' | 'authenticated' | 'viewer' | 'operator' | 'admin';

const within = (route: string, base: string): boolean => route === base || route.startsWith(base + '/');
const readMethod = (method: string): boolean => method === 'GET' || method === 'HEAD';

/** Classify SvelteKit's resolved route ID, never a user-supplied URL pathname.
 * Route IDs preserve the same policy for page-data requests and encoded URLs.
 * Machine endpoints enforce their own host/enrollment/telemetry credentials.
 */
export function routePermission(routeId: string | null, method: string): RoutePermission {
    method = method.toUpperCase();
    const reading = readMethod(method);
    if (routeId === null) return reading ? 'viewer' : 'operator';
    // These cannot occur in this application's resolved route IDs. Fail closed
    // if a future caller accidentally supplies a raw or noncanonical pathname.
    if (!routeId.startsWith('/') || /[%\\?#\x00-\x1f\x7f]/.test(routeId)
        || routeId !== '/' && routeId.split('/').slice(1).some(part => !part || part === '.' || part === '..')) return 'admin';

    if (within(routeId, '/api/agent')) return 'machine';
    if (routeId === '/api/telemetry' && method === 'POST') return 'machine';
    if (routeId === '/api/leaderboard' && reading) return 'public';
    if ((routeId === '/login' || routeId === '/setup') && reading) return 'public';
    if ((routeId === '/api/auth/login' || routeId === '/api/auth/setup') && method === 'POST') return 'public';
    if (routeId === '/account' || ['/api/auth/me', '/api/auth/logout', '/api/auth/password'].includes(routeId)) return 'authenticated';

    if (within(routeId, '/api/users') || within(routeId, '/settings') || within(routeId, '/api/auth')
        || within(routeId, '/api/server-keys') || within(routeId, '/server-keys') || within(routeId, '/keys')) return 'admin';

    if (!reading && ['/api/hosts', '/api/settings', '/api/game-files'].some(base => within(routeId, base))) return 'admin';
    if (routeId === '/api/provisioning/[id]/override') return 'admin';
    // These endpoints mix operational actions with global policy and schedule
    // changes. Per-incident/job actions remain available to operators.
    if (!reading && ['/api/maintenance', '/api/plutonium', '/api/watchdog'].includes(routeId)) return 'admin';

    // Summaries remain visible to viewers; raw configuration, historical file
    // bytes, and unfiltered diagnostics may contain runtime credentials.
    if (routeId === '/configs/[id]' || routeId === '/api/configs/[id]' || routeId === '/api/configs/inspect'
        || routeId === '/api/campaigns/[id]/file/[fileId]' || routeId === '/api/deployments/[id]/file/[fileId]'
        || routeId === '/api/servers/[name]/logs/[file]' || routeId === '/api/servers/[name]/telemetry-requests') return 'operator';

    return reading ? 'viewer' : 'operator';
}

/** A browser role never substitutes for a machine credential. */
export function roleAllows(role: UserRole, permission: RoutePermission): boolean {
    if (!['viewer', 'operator', 'admin'].includes(role)) return false;
    if (permission === 'machine') return false;
    if (permission === 'public' || permission === 'authenticated' || permission === 'viewer') return true;
    if (permission === 'operator') return role === 'operator' || role === 'admin';
    return permission === 'admin' && role === 'admin';
}