package middleware

import (
	"net/http"

	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/authzd.git/pkg/rpc"
	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/cfg"
	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/domain"
	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/pls"
)

func RequirePermission(permission Permission, ability rpc.Ability) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			user := cfg.CurrentUser.From(r.Context())

			reply, err := ability.Allowed(r.Context(),
				permission.RequestFor(user, &domain.Sparkle{ID: "*"}),
			)
			if err != nil {
				pls.LogError(r.Context(), err)
				w.WriteHeader(http.StatusForbidden)
				return
			}

			if reply.Result {
				next.ServeHTTP(w, r)
			} else {
				w.WriteHeader(http.StatusForbidden)
			}
		})
	}
}