checker.go

// Copyright 2017-2026 Allow2 Pty Ltd. All rights reserved.
// Use of this source code is governed by the Allow2 API and SDK Licence.

package allow2service

import (
	"encoding/json"
	"fmt"
	"sort"
	"strconv"
	"strings"
)

// permissionChecker checks child permissions via the Allow2 Service API.
// Results are cached per user for a configurable TTL.
type permissionChecker struct {
	httpClient  HTTPClient
	cache       Cache
	serviceHost string
	cacheTTL    int
}

// Check checks permissions for a user's linked child account.
// Pass an empty string for timezone to use the server default.
func (p *permissionChecker) Check(accessToken, userID string, activities []ActivityInput, timezone string) (*CheckResult, error) {
	// Build normalized activity list for API and cache key
	normalized := normalizeActivities(activities)

	// Check cache first
	cacheKey := buildCacheKey(userID, normalized)
	if cached, ok := p.cache.Get(cacheKey); ok {
		var data map[string]interface{}
		if err := json.Unmarshal([]byte(cached), &data); err == nil {
			return CheckResultFromAPIResponse(data), nil
		}
		p.cache.Delete(cacheKey)
	}

	// Build payload
	payload := map[string]interface{}{
		"access_token": accessToken,
		"activities":   normalized,
		"log":          true,
	}

	if timezone != "" {
		payload["tz"] = timezone
	}

	response, err := p.httpClient.Post(
		p.serviceHost+"/serviceapi/check",
		payload,
		nil,
	)
	if err != nil {
		return nil, &ApiError{
			Allow2Error: Allow2Error{Message: fmt.Sprintf("Permission check request failed: %v", err)},
		}
	}

	// 401/403 = unpaired
	if response.IsUnauthorized() {
		return nil, &UnpairedError{
			Allow2Error: Allow2Error{Message: "Service account is no longer linked. Re-pairing required."},
			UserID:      userID,
		}
	}

	if !response.IsSuccess() {
		body := response.JSON()
		return nil, &ApiError{
			Allow2Error:    Allow2Error{Message: fmt.Sprintf("Permission check failed: HTTP %d", response.StatusCode)},
			HTTPStatusCode: response.StatusCode,
			ResponseBody:   body,
		}
	}

	data := response.JSON()
	if data == nil {
		return nil, &ApiError{
			Allow2Error:    Allow2Error{Message: "Permission check returned invalid JSON"},
			HTTPStatusCode: response.StatusCode,
		}
	}

	result := CheckResultFromAPIResponse(data)

	// Cache the raw response
	if rawJSON, err := json.Marshal(data); err == nil {
		p.cache.Set(cacheKey, string(rawJSON), p.cacheTTL)
	}

	return result, nil
}

// IsAllowed is a convenience method: checks if all specified activities are allowed.
func (p *permissionChecker) IsAllowed(accessToken, userID string, activityIDs []int) (bool, error) {
	inputs := make([]ActivityInput, len(activityIDs))
	for i, id := range activityIDs {
		inputs[i] = ActivityInput{ID: id, Log: true}
	}

	result, err := p.Check(accessToken, userID, inputs, "")
	if err != nil {
		return false, err
	}

	for _, activity := range result.Activities {
		if !activity.Allowed {
			return false, nil
		}
	}

	return true, nil
}

// InvalidateCache invalidates the cached check result for a user.
func (p *permissionChecker) InvalidateCache(userID string, activities []ActivityInput) {
	normalized := normalizeActivities(activities)
	cacheKey := buildCacheKey(userID, normalized)
	p.cache.Delete(cacheKey)
}

// normalizeActivities converts ActivityInput slice to the standard API format.
func normalizeActivities(activities []ActivityInput) []map[string]interface{} {
	result := make([]map[string]interface{}, len(activities))
	for i, a := range activities {
		result[i] = map[string]interface{}{
			"id":  a.ID,
			"log": a.Log,
		}
	}
	return result
}

// buildCacheKey creates a deterministic cache key for a user + activities combination.
func buildCacheKey(userID string, activities []map[string]interface{}) string {
	ids := make([]int, 0, len(activities))
	for _, a := range activities {
		if id, ok := a["id"]; ok {
			switch v := id.(type) {
			case int:
				ids = append(ids, v)
			case float64:
				ids = append(ids, int(v))
			}
		}
	}
	sort.Ints(ids)

	parts := make([]string, len(ids))
	for i, id := range ids {
		parts[i] = strconv.Itoa(id)
	}

	return "allow2_check_" + userID + "_" + strings.Join(parts, "_")
}