<?php

namespace App\Utilities;

use App\Models\Auth\User;

class SystemAccess
{
    public const SUPER_ADMIN = 'super_admin';
    public const ADMIN = 'admin';
    public const USER = 'user';

    public static function roleName(?User $user = null): string
    {
        $user ??= user();

        if (! $user) {
            return '';
        }

        // 身份变更必须立即生效，不能沿用权限库中已缓存的旧角色。
        $roles = $user->roles()->pluck('name')->all();

        foreach ([self::SUPER_ADMIN, self::ADMIN, self::USER] as $role) {
            if (in_array($role, $roles, true)) {
                return $role;
            }
        }

        return '';
    }

    public static function canOpenSettings(?User $user = null): bool
    {
        return in_array(self::roleName($user), [self::SUPER_ADMIN, self::ADMIN], true);
    }

    public static function isSuperAdmin(?User $user = null): bool
    {
        return self::roleName($user) === self::SUPER_ADMIN;
    }

    public static function canManageUser(User $actor, User $target): bool
    {
        if (self::isSuperAdmin($actor)) {
            return true;
        }

        return self::roleName($actor) === self::ADMIN
            && self::roleName($target) === self::USER;
    }

    public static function assignableRoles(?User $actor = null): array
    {
        $actor ??= user();

        if (self::isSuperAdmin($actor)) {
            return [
                self::SUPER_ADMIN => '主管理员（最高权限）',
                self::ADMIN => '管理员',
                self::USER => '普通用户',
            ];
        }

        return [self::USER => '普通用户'];
    }

    public static function roleLabels(): array
    {
        return [
            self::SUPER_ADMIN => '主管理员',
            self::ADMIN => '管理员',
            self::USER => '普通用户',
        ];
    }
}