import { prisma } from '@/lib/prisma'
import type { Prisma } from '@prisma/client'

// Explicitly approved accounts. Names are documentation, never authorization keys.
const PERFORMANCE_SALARY_USER_IDS = new Set([
  'c156778c-307d-42aa-89d3-f785aeb3ef86', // 无邪
  '463c5a60-c8a8-45dd-b4cd-4a31a6b1b84f', // 清云
  'c041d8d8-93db-41f1-984d-5f76f114da48', // 伯言
  '2b1ccc12-844c-4eff-8006-58607157efc1', // 元泽
])

/** Read current account state; ordinary administrator roles do not grant access. */
export async function resolvePerformanceSalaryAccess(userId: string | null | undefined, db: Pick<Prisma.TransactionClient, 'user'> = prisma) {
  if (!userId) return { canView: false, canEdit: false }

  const user = await db.user.findUnique({
    where: { id: userId },
    select: { id: true, isSuperAdmin: true, isActive: true, status: true, archivedAt: true },
  })
  if (!user?.isActive || user.status !== 'active' || user.archivedAt) return { canView: false, canEdit: false }

  return { canView: user.isSuperAdmin || PERFORMANCE_SALARY_USER_IDS.has(user.id), canEdit: user.isSuperAdmin }
}

export async function canViewPerformanceSalary(userId: string | null | undefined): Promise<boolean> {
  return (await resolvePerformanceSalaryAccess(userId)).canView
}