package models

import (
	"rocketgit.ru/rsmon/worker/app/models/concerns"
)

// Access represents membership of a User (or ApiKey) within a tenant
// Account, optionally scoped to a Group or Monitor.
//
// A User can hold many Access rows across many Accounts — the Access
// table is the source of truth for "who can see what". Each row answers:
//
//	"Does user U have permission P on scope S of account A?"
//
// Where:
//
//   - A = AccountID           (tenant)
//   - U = UserID              (or ApiKeyID for service tokens)
//   - P = Role                ("owner" | "admin" | "manager" | "view" |
//     "notify")
//   - S = Kind + (GroupID | MonitorID) — defaults to account-wide when
//     Kind = "account" and both ids are
//     nil.
//
// One Access row may also reference the Invite that produced it via
// InviteID. The Invite is preserved after registration so the access
// history stays auditable — system-registered users and admin-added
// users have nil InviteID.
//
// See docs/plans/users-and-rbac.md for the full RBAC matrix.
type Access struct {
	concerns.Model
	AccountID int64    `gorm:"type:bigint REFERENCES accounts(id)" json:"account_id"`
	Account   *Account `json:"-"`

	// Kind access kind, account \ group \ monitor
	Kind string `gorm:"not null;default:'account'" json:"kind"`

	UserID   *int64  `gorm:"type:bigint REFERENCES users(id)" json:"-"`
	User     *User   `json:"-"`
	ApiKeyID *int64  `gorm:"type:bigint REFERENCES api_keys(id)" json:"-"` //nolint:revive // accepted lint exception
	ApiKey   *ApiKey `json:"-"`                                            //nolint:revive // accepted lint exception
	InviteID *int64  `gorm:"type:bigint REFERENCES invites(id)" json:"-"`
	Invite   *Invite `json:"-"`

	GroupID   *int64 `gorm:"type:bigint REFERENCES groups(id)" json:"group_id,omitempty"`
	MonitorID *int64 `gorm:"type:bigint REFERENCES monitors(id)" json:"monitor_id,omitempty"`

	Role string `json:"role"`

	// SeatType is additive to Role: role remains the authorization decision,
	// while seat type is the billing entitlement.
	SeatType    string `gorm:"size:16;not null;default:'login'" json:"seat_type"`
	Status      string `gorm:"size:16;not null;default:'active'" json:"status"`
	NotifyOnly  bool   `gorm:"not null;default:false" json:"notify_only"`
	SeatAddonID *int64 `json:"seat_addon_id,omitempty"`

	concerns.Timestamped `json:"-"`
	Audited
}