import { computed, ref } from 'vue'
import { useAuth } from './useAuth'

export const rolesConfig = ref(null)

export const fetchRolesConfig = async () => {
  if (rolesConfig.value) return
  try {
    const data = await $fetch('/api/roles')
    rolesConfig.value = data
  } catch (err) {
    console.error('Failed to fetch roles config', err)
  }
}

export const usePermissions = () => {
  const auth = useAuth()

  // 检查用户是否可以访问后台
  const canAccessAdmin = computed(() => {
    if (!auth.user.value || !auth.user.value.role) return false
    const role = auth.user.value.role
    if (rolesConfig.value && rolesConfig.value[role]) {
      return rolesConfig.value[role].canAccessAdmin
    }
    // Fallback if config not loaded
    return ['SONG_ADMIN', 'ADMIN', 'SUPER_ADMIN', 'STAFF', 'VICE_MINISTER', 'MINISTER', 'RESIDENT'].includes(role)
  })

  // 检查用户是否可以访问指定页面
  const canAccessPage = (page: string): boolean => {
    if (!auth.user.value || !auth.user.value.role) return false
    const role = auth.user.value.role

    // 超级管理员可以访问所有页面 (作为兜底保护)
    if (role === 'SUPER_ADMIN') return true

    if (rolesConfig.value && rolesConfig.value[role]) {
      return rolesConfig.value[role].pages.includes(page)
    }

    return false
  }

  // 获取用户可访问的页面列表
  const getUserPages = computed(() => {
    if (!auth.user.value || !auth.user.value.role) return []
    const role = auth.user.value.role
    
    if (rolesConfig.value && rolesConfig.value[role]) {
      return rolesConfig.value[role].pages
    }
    
    return []
  })

  // 角色检查
  const isUser = computed(() => auth.user.value?.role === 'USER')
  const isSongAdmin = computed(() => auth.user.value?.role === 'SONG_ADMIN')
  const isAdmin = computed(() => auth.user.value?.role === 'ADMIN')
  const isSuperAdmin = computed(() => auth.user.value?.role === 'SUPER_ADMIN')

  // 权限组合检查 (为了兼容性保留，但最好根据实际权限判断)
  const isAdminOrAbove = computed(() => {
    const role = auth.user.value?.role
    return ['ADMIN', 'SUPER_ADMIN', 'VICE_MINISTER', 'MINISTER'].includes(role)
  })

  const isSongAdminOrAbove = computed(() => {
    const role = auth.user.value?.role
    return ['SONG_ADMIN', 'ADMIN', 'SUPER_ADMIN', 'STAFF', 'VICE_MINISTER', 'MINISTER', 'RESIDENT'].includes(role)
  })

  // 检查是否可以管理用户角色
  const canManageUserRole = (targetRole: string): boolean => {
    if (!auth.user.value) return false

    // 只有超级管理员可以分配角色
    if (auth.user.value.role === 'SUPER_ADMIN') {
      return true
    }

    return false
  }

  // 检查是否可以打印排期
  const canPrintSchedule = computed(() => {
    if (!auth.user.value) return false
    const role = auth.user.value.role
    return ['SONG_ADMIN', 'ADMIN', 'SUPER_ADMIN'].includes(role)
  })

  return {
    // 页面访问权限
    canAccessAdmin,
    canAccessPage,
    getUserPages,

    // 角色检查
    isUser,
    isSongAdmin,
    isAdmin,
    isSuperAdmin,
    isAdminOrAbove,
    isSongAdminOrAbove,

    // 功能权限
    canPrintSchedule,

    // 用户管理权限
    canManageUserRole
  }
}