/**
 * Uzivatel muze patrit do vic firem najednou (napr. externista, ktery dela
 * servicedesk dvema klientum). Proto `memberships`, ne jedno `tenantId`.
 *
 * Role je vzdy az uvnitr firmy. Pristup napric firmami je zvlast, jako
 * `platformAdmin` - to je nase pravo, ne zakaznicke.
 */

import type { Membership, PublicUser } from './shared/users.js';

/** Clenstvi a verejny tvar uctu jsou sdilene s webem, viz src/shared/users.ts. */
export type { Membership, PublicUser };

export interface User {
  id: string;
  email: string;
  /** bcrypt hash - nikdy neposilat na klienta */
  passwordHash: string;
  name: string;
  /** Vidi napric vsemi firmami a muze mezi nimi prepinat. */
  platformAdmin: boolean;
  memberships: Membership[];
}

export interface JwtPayload {
  sub: string;
  email: string;
  /**
   * Jen u tokenu impersonace: kdo se za uzivatele vydava.
   * Bez toho by v auditu zustalo jen "uzivatel to udelal sam".
   */
  act?: string;
  actEmail?: string;
  /** Jen u impersonace: smi i zapisovat. */
  writes?: boolean;
}

/**
 * Prava spocitana jednou za request, viz `middleware/tenant.ts`.
 *
 * Doplnek k `req.user` z `middleware/auth.ts`. Jen typ, zadny kod - proto
 * import typu, ne modulu.
 */
declare global {
  // eslint-disable-next-line @typescript-eslint/no-namespace
  namespace Express {
    interface Request {
      access?: import('./data/access.js').Access;
    }
  }
}

export function toPublicUser(user: User): PublicUser {
  const { passwordHash: _passwordHash, ...rest } = user;
  return rest;
}

/** Role uzivatele v dane firme. Prazdne pole = do firmy nepatri. */
export function rolesIn(user: User, tenantId: string): string[] {
  return user.memberships.find((m) => m.tenantId === tenantId)?.roleIds ?? [];
}