/* roles-data.jsx — RBAC data layer. window.cdeRoles. Plain JS (no JSX). */
(function () {
  "use strict";
  const sb = window.sb;
  const cdeData = window.cdeData;

  // danh mục quyền cố định (id ổn định + nhãn hiển thị)
  window.CDE_PERMS = [
    { id: "view", label: "Xem" },
    { id: "download", label: "Tải về" },
    { id: "edit", label: "Sửa / Nạp" },
    { id: "approve", label: "Duyệt" },
    { id: "delete", label: "Xoá" },
    { id: "share", label: "Chia sẻ" },
    { id: "manage", label: "Quản trị" },
  ];

  async function list() {
    if (!sb) return [];
    try {
      const pid = await cdeData.projectId();
      const { data, error } = await sb.from("roles").select("*").eq("project_id", pid).order("created_at");
      if (error) { console.warn("roles.list", error.message); return []; }
      return (data || []).map(r => ({ id: r.id, name: r.name, permissions: r.permissions || [] }));
    } catch (e) { console.warn("roles.list", e); return []; }
  }

  async function create(name, permissions) {
    const pid = await cdeData.projectId();
    const { data, error } = await sb.from("roles")
      .insert({ project_id: pid, name: name, permissions: permissions || [] }).select().maybeSingle();
    if (error) throw error;
    return data;
  }

  async function update(id, patch) {
    const row = {};
    if (patch.name != null) row.name = patch.name;
    if (patch.permissions != null) row.permissions = patch.permissions;
    const { data, error } = await sb.from("roles").update(row).eq("id", id).select().maybeSingle();
    if (error) throw error;
    return data;
  }

  async function remove(id) {
    const { error } = await sb.from("roles").delete().eq("id", id);
    if (error) throw error;
  }

  // thành viên + danh sách roleIds đang giữ
  async function membersWithRoles() {
    if (!sb) return [];
    const pid = await cdeData.projectId();
    const [{ data: ps, error: e1 }, { data: mrs, error: e2 }] = await Promise.all([
      sb.from("profiles").select("id, full_name, discipline, role"),
      sb.from("member_roles").select("user_id, role_id").eq("project_id", pid),
    ]);
    if (e1) { console.warn("members", e1.message); return []; }
    const byUser = {};
    for (const m of (mrs || [])) (byUser[m.user_id] = byUser[m.user_id] || []).push(m.role_id);
    return (ps || []).map(p => ({
      id: p.id, name: p.full_name || "(không tên)", disc: p.discipline, accountRole: p.role,
      roleIds: byUser[p.id] || [],
    }));
  }

  async function assign(userId, roleId) {
    const pid = await cdeData.projectId();
    const { error } = await sb.from("member_roles").insert({ project_id: pid, user_id: userId, role_id: roleId });
    if (error && error.code !== "23505") throw error;   // bỏ qua trùng (unique)
  }

  async function unassign(userId, roleId) {
    const { error } = await sb.from("member_roles").delete().eq("user_id", userId).eq("role_id", roleId);
    if (error) throw error;
  }

  // roleIds của user đang đăng nhập (để enforce ở app)
  async function myRoleIds() {
    if (!sb) return [];
    try {
      const { data: u } = await sb.auth.getUser();
      const uid = u && u.user && u.user.id;
      if (!uid) return [];
      const { data, error } = await sb.from("member_roles").select("role_id").eq("user_id", uid);
      if (error) return [];
      return (data || []).map(r => r.role_id);
    } catch { return []; }
  }

  window.cdeRoles = { list, create, update, remove, membersWithRoles, assign, unassign, myRoleIds };
})();