package gateway

import (
	"encoding/json"
	"errors"
	"net/http"

	capreg "git.yeij.top/AskaEth/Cyrene_v2/internal/capability/registry"
	apperr "git.yeij.top/AskaEth/Cyrene_v2/internal/errors"
)

// adminSetPolicy 更新插入某个能力的可达性标记。它是
// 带审计的管理写示例（仅 owner，由路由注册强制）。
func (s *Server) adminSetPolicy(w http.ResponseWriter, r *http.Request) {
	var req policyRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
		return
	}
	if req.Name == "" {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "name is required"))
		return
	}
	if s.caps == nil {
		s.auditClaims(r, "policy.set", "error")
		writeError(w, apperr.Wrap(apperr.ErrInternal, "policy_unavailable", "capability service is not configured"))
		return
	}
	err := s.caps.SetPolicy(req.Name, capreg.ToolPolicy{AllowInGroup: req.AllowInGroup, AllowInStranger: req.AllowInStranger})
	if err != nil {
		s.auditClaims(r, "policy.set", "error")
		if errors.Is(err, capreg.ErrNotFound) {
			writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "capability %q not found", req.Name))
			return
		}
		writeError(w, apperr.Wrap(apperr.ErrInternal, "policy_failed", "failed to set policy"))
		return
	}
	s.auditClaims(r, "policy.set", "ok")
	writeJSON(w, http.StatusOK, map[string]any{"name": req.Name, "allowInGroup": req.AllowInGroup, "allowInStranger": req.AllowInStranger})
}