import { canAccessPortal, hasAllDepartmentAccess } from "../config/departmentAccess.js";

export const getPolicyReadScope = user => ({
    // Accounts and POS Management work across the shared policy book.
    // Operations users remain restricted to their own entries unless they
    // also hold an all-department role.
    all: hasAllDepartmentAccess(user) ||
        canAccessPortal(user, "accounts") ||
        canAccessPortal(user, "pos-management"),
    userId: Number(user?.id)
});

export const normalizePolicyReadScope = scope => {
    const all = Boolean(scope && typeof scope === "object" && scope.all);
    const userId = Number(scope && typeof scope === "object" ? scope.userId : scope);
    if (!all && (!Number.isInteger(userId) || userId <= 0)) {
        const error = new Error("A valid authenticated user is required for policy access");
        error.statusCode = 401;
        throw error;
    }
    return { all, userId };
};

export const policyOwnershipFilter = (scope, column = "created_by") => {
    const normalized = normalizePolicyReadScope(scope);
    return normalized.all
        ? { sql: "1 = 1", params: [], scope: normalized }
        : { sql: `${column} = ?`, params: [normalized.userId], scope: normalized };
};
