import { canEditProject, canUseProject, canViewProject, createApiError } from "@inkeep/agents-core";
import { createMiddleware } from "hono/factory";
import { HTTPException } from "hono/http-exception";

//#region src/middleware/projectAccess.ts
/**
* Middleware to check project-level access.
*/
const requireProjectPermission = (permission = "view") => createMiddleware(async (c, next) => {
	if (process.env.ENVIRONMENT === "test") {
		await next();
		return;
	}
	const userId = c.get("userId");
	const tenantId = c.get("tenantId");
	const tenantRole = c.get("tenantRole");
	const projectId = c.req.param("projectId") || c.req.param("id");
	if (!userId || !tenantId) throw createApiError({
		code: "unauthorized",
		message: "User or organization context not found",
		instance: c.req.path
	});
	if (!projectId) throw createApiError({
		code: "bad_request",
		message: "Project ID is required",
		instance: c.req.path
	});
	if (userId === "system" || userId.startsWith("apikey:")) {
		await next();
		return;
	}
	try {
		let hasAccess = false;
		switch (permission) {
			case "view":
				hasAccess = await canViewProject({
					userId,
					projectId,
					orgRole: tenantRole
				});
				break;
			case "use":
				hasAccess = await canUseProject({
					userId,
					projectId,
					orgRole: tenantRole
				});
				break;
			case "edit":
				hasAccess = await canEditProject({
					userId,
					projectId,
					orgRole: tenantRole
				});
				break;
		}
		if (!hasAccess) throw createApiError({
			code: "not_found",
			message: "Project not found",
			instance: c.req.path
		});
		await next();
	} catch (error) {
		if (error instanceof HTTPException) throw error;
		const errorMessage = error instanceof Error ? error.message : "Unknown error";
		throw createApiError({
			code: "internal_server_error",
			message: "Failed to verify project access",
			instance: c.req.path,
			extensions: { internalError: errorMessage }
		});
	}
});

//#endregion
export { requireProjectPermission };