<?php

namespace App\Modules\Identity\Services;

use Illuminate\Support\Facades\DB;

final class Permissions
{
    public const COMPANY = ['company.view', 'company.edit', 'unit.create', 'access.manage'];
    public const UNIT = ['unit.view', 'unit.edit'];

    public function has(int $user, int $tenant, int $company, string $permission, ?int $unit = null): bool
    {
        return DB::table('permission_grants')->where('user_id', $user)->where('tenant_id', $tenant)
            ->where('company_id', $company)->where('permission', $permission)->where('unit_id', $unit)->exists();
    }

    public function require(int $user, int $tenant, int $company, string $permission, ?int $unit = null): void
    {
        abort_unless($this->has($user, $tenant, $company, $permission, $unit), 403, 'Acção não autorizada.');
    }

    public function unitIds(int $user, int $tenant, int $company): array
    {
        return DB::table('permission_grants')->where('user_id', $user)->where('tenant_id', $tenant)
            ->where('company_id', $company)->where('permission', 'unit.view')->pluck('unit_id')->map(fn ($id) => (int) $id)->all();
    }
}