// candidates.resource.ts — security helpers
import { eq, and, isNull, type SQL } from 'drizzle-orm';
import { candidates } from './schema';
import { masks } from '../../lib/masks';

// Auto-derived from q.scope("organization") + audit-injected deletedAt.
// 2 predicates: tenant scope AND soft-delete filter.
export function buildFirewallConditions(ctx: AppContext): SQL | undefined {
  return and(
    eq(candidates.organizationId, ctx.activeOrgId!),
    isNull(candidates.deletedAt),
  );
}

// q.scope() + audit fields → systemManaged. Always rejected from client input.
export const GUARDS_CONFIG = {
  createable: new Set(['name', 'email', 'phone', 'resumeUrl', 'source', 'internalNotes']),
  updatable:  new Set(['name', 'email', 'phone', 'resumeUrl', 'source', 'internalNotes']),
  systemManaged: new Set([
    'createdAt', 'createdBy', 'modifiedAt', 'modifiedBy',
    'deletedAt', 'deletedBy',
    'organizationId',                  // ← added by q.scope("organization")
  ]),
};

// Derived from masking[col].show.roles. Non-admins receive masked values.
export function maskCandidate<T extends Record<string, any>>(record: T, ctx: AppContext): T {
  const masked: any = { ...record };
  if (!ctx.roles?.some(r => ['admin', 'owner'].includes(r))) {
    if (masked.email != null)         masked.email = masks.email(masked.email);
    if (masked.phone != null)         masked.phone = masks.phone(masked.phone);
    if (masked.internalNotes != null) masked.internalNotes = masks.redact(masked.internalNotes);
  }
  return masked;
}

// candidates.routes.ts — unified read pipeline (excerpt)
const VIEWS = {
  pipeline: {
    fields: ['id', 'name', 'source'],
    access: { roles: ['member', 'admin', 'owner'] },
    query:  { filterable: ['source'], searchable: ['name'], sortable: ['createdAt', 'name'], defaultSort: '-createdAt' },
  },
  full: {
    fields: ['id', 'name', 'email', 'phone', 'resumeUrl', 'source', 'internalNotes'],
    access: { roles: ['admin', 'owner'] },
    // Masking query gate satisfied: full.access ∩ masking[*].show.roles = ['admin']
    query:  { filterable: ['source', 'email', 'phone'], searchable: ['name', 'email', 'internalNotes'], sortable: ['createdAt', 'name', 'email'] },
  },
} as const;

// GET /candidates/views/:viewName — named view projection
app.get('/views/:viewName', async (c) => {
  const ctx = c.get('ctx');
  if (!ctx.authenticated) return c.json(AuthErrors.required(), 401);

  const viewName = c.req.param('viewName');
  const params = Object.fromEntries(new URL(c.req.url).searchParams);
  const view = VIEWS[viewName as keyof typeof VIEWS];
  if (!view) return c.json({ error: 'Unknown view', code: 'VIEW_NOT_FOUND' }, 400);

  // Per-view access gate
  if (!await evaluateAccess(view.access, ctx)) {
    return c.json(AccessErrors.roleRequired(view.access.roles, ctx.roles), 403);
  }

  // Filter / sort / search are bounded by the view's query allowlist.
  // Masked columns (email, phone, internalNotes) are excluded unless the
  // view's query.{cap} explicitly lists them — validator already proved at
  // compile time that the view's access roles satisfy masking.show.roles.
  const filterCols = new Set(view.query.filterable ?? []);
  const sortCols   = new Set(view.query.sortable   ?? []);
  const searchCols = view.query.searchable         ?? [];

  const where: SQL[] = [];
  const fw = buildFirewallConditions(ctx);
  if (fw) where.push(fw);

  for (const [k, v] of Object.entries(params)) {
    const [field, op] = k.split('.');
    if (!filterCols.has(field) || !(field in candidates)) continue;
    const col = candidates[field as keyof typeof candidates];
    where.push(op === 'like'
      ? sql`${col} LIKE ${'%' + escapeLike(v) + '%'} ESCAPE '\\'`
      : eq(col, parseFilterValue(v)));
  }

  if (params.search && searchCols.length) {
    const term = '%' + escapeLike(params.search) + '%';
    where.push(or(...searchCols.map(c =>
      sql`${candidates[c as keyof typeof candidates]} LIKE ${term} ESCAPE '\\'`,
    ))!);
  }

  // …pagination, sort, project view.fields, run query…
  const rows = await db.select(/* projected fields */).from(candidates).where(and(...where));
  return jsonWithEtag(c, { data: maskCandidates(rows, ctx), view: viewName });
});