package models

import (
	"time"

	"go.mongodb.org/mongo-driver/v2/bson"
)

// Account roles.
//
// Deliberately the same three words as the control plane's own roles rather
// than a second vocabulary: a customer who reads "admin" in the portal and
// "admin" in their instance should not have to learn that they mean different
// things. They govern different scopes — this one governs the HQ account —
// but they mean the same thing about power.
//
// Billing stays owner-only. Owners and admins may invite people, create
// instances and grant instance access.
const (
	AccountRoleOwner  = "owner"
	AccountRoleAdmin  = "admin"
	AccountRoleMember = "member"
)

func ValidAccountRole(r string) bool {
	switch r {
	case AccountRoleOwner, AccountRoleAdmin, AccountRoleMember:
		return true
	}
	return false
}

// AccountRoleAtLeastAdmin is the single definition of "may manage people and
// instances". Every guard calls this rather than comparing strings, so widening
// the rule is one edit.
func AccountRoleAtLeastAdmin(r string) bool {
	return r == AccountRoleOwner || r == AccountRoleAdmin
}

// InstanceMember records that one HQ person holds a projected user inside one
// cloud instance.
//
// It is admin's index of the projection, not the authority: the control-plane
// `users` row IS the access. This row exists so the portal can list who is on
// an instance without reading the control plane, and so a password change can
// find every row to update without scanning every instance.
//
// ControlUserID is the projected users.user_id. Role is the role that user
// holds INSIDE the instance, which is not the person's account role.
type InstanceMember struct {
	ID             bson.ObjectID `bson:"_id,omitempty" json:"-"`
	MemberID       string        `bson:"member_id" json:"member_id"`
	AccountID      string        `bson:"account_id" json:"account_id"`
	InstanceID     string        `bson:"instance_id" json:"instance_id"`
	CustomerUserID string        `bson:"customer_user_id" json:"customer_user_id"`
	ControlUserID  string        `bson:"control_user_id" json:"control_user_id"`
	Role           string        `bson:"role" json:"role"`
	Email          string        `bson:"email" json:"email"`
	CreatedAt      time.Time     `bson:"created_at" json:"created_at"`
}
