<?php

namespace App\Traits;

use App\Models\User;
use Spatie\Permission\Exceptions\PermissionDoesNotExist;
use Illuminate\Support\Facades\Schema;

trait AutoApplyPermissionCheck
{
    /**
     * Apply permission check to a model query
     *
     * @param string $modelClass The fully qualified model class name
     * @return \Illuminate\Database\Eloquent\Builder
     */
    protected function queryWithPermission($modelClass)
    {
        return $modelClass::withPermissionCheck();
    }

    /**
     * Apply permission scope to the query based on user's permissions
     *https://temp-file.workdo.io/download/FjkuKXEofvEcEkCmnOQerQ0Q7YN6aD08
     * @param \Illuminate\Database\Eloquent\Builder $queryquery
     * @param string $module The module name (e.g., 'roles', 'permissions')
     * @return \Illuminate\Database\Eloquent\Builder
     */
    public function applyPermissionScope($query, $module)
    {
        // Skip permission check if no authenticated user (e.g., in console commands)
        if (!auth()->check()) {
            return $query;
        }

        $user = auth()->user();

        // Check if user is superadmin - they can see everything
        if ($user->hasRole(['superadmin'])) {
            return $query;
        }

        $tableName = $query->getModel()->getTable();

        // For company users, show their records and their employees' records
        if ($user->hasRole(['company'])) {
            if ($this->hasColumnCached($tableName, 'created_by')) {
                return $query->whereIn('created_by', getCompanyAndUsersId());
            }
        }

        try {
            $module = str_replace('_', '-', $module);
            if ($user->hasPermissionTo("manage-own-{$module}")) {
                return $query->where(function ($q) use ($user, $tableName) {
                    if ($this->hasColumnCached($tableName, 'created_by')) {
                        $q->where('created_by', $user->id);
                    }
                    if ($this->hasColumnCached($tableName, 'employee_id')) {
                        // Use OR only if created_by already applied
                        $q->orWhere('employee_id', $user->id);
                    }
                });
            }

            // If user has permission to list all items, return the query without filtering
            if ($user->hasPermissionTo("manage-any-{$module}")) {
                if ($this->hasColumnCached($tableName, 'created_by')) {
                    return $query->whereIn('created_by', getCompanyAndUsersId());
                }
            }
        } catch (PermissionDoesNotExist $e) {
            // Permission doesn't exist, check for access to module instead
            if ($user->hasPermissionTo("access-{$module}-module")) {
                // Default to showing only own records if they have module access
                if ($this->hasColumnCached($tableName, 'created_by')) {
                    return $query->where('created_by', $user->id);
                }
                return $query;
            }
        }

        // Check employee role after specific permissions
        if ($user->hasRole(['employee'])) {
            return $this->applyEmployeeRoleFiltering($query, $user, null, $module);
        }

        // Check Default manage Permission
        try {
            if ($user->hasPermissionTo("manage-{$module}")) {
                if ($this->hasColumnCached($tableName, 'created_by')) {
                    return $query->whereIn('created_by', getCompanyAndUsersId());
                }
            }
        } catch (PermissionDoesNotExist $e) {
            // Permission doesn't exist, check for access to module instead
            if ($user->hasPermissionTo("access-{$module}-module")) {
                // Default to showing only own records if they have module access
                if ($this->hasColumnCached($tableName, 'created_by')) {
                    return $query->where('created_by', $user->id);
                }
                return $query;
            }
        }

        return $query;
    }

    /**
     * Check if table has column with caching for request life
     */
    private function hasColumnCached($table, $column)
    {
        static $columnCache = [];
        $key = "{$table}.{$column}";
        
        if (!isset($columnCache[$key])) {
            $columnCache[$key] = Schema::hasColumn($table, $column);
        }
        
        return $columnCache[$key];
    }


    private function applyEmployeeRoleFiltering($query, $user, $permission = null, $module)
    {
        $module = str_replace('_', '-', $module);

        // Check if employee has manage permission
        $hasManagePermission = false;
        try {
            $hasManagePermission = $user->hasPermissionTo("manage-{$module}");
        } catch (PermissionDoesNotExist $e) {
            // Continue with model-specific filtering
        }

        $modelClass = get_class($query->getModel());
        $tableName = $query->getModel()->getTable();

        switch ($modelClass) {
            case 'App\Models\User':
                return $query->where('id', $user->id);
            case 'App\Models\Award':
            case 'App\Models\Promotion':
            case 'App\Models\EmployeeGoal':
            case 'App\Models\Resignation':
            case 'App\Models\Termination':
            case 'App\Models\Warning':
            case 'App\Models\Trip':
            case 'App\Models\EmployeeTransfer':
            case 'App\Models\EmployeeReview':
            case 'App\Models\EmployeeTraining':
            case 'App\Models\EmployeeContract':
            case 'App\Models\LeaveBalance':
            case 'App\Models\LeaveApplication':
            case 'App\Models\AttendanceRecord':
            case 'App\Models\AttendanceRegularization':
            case 'App\Models\TimeEntry':
            case 'App\Models\EmployeeSalary':
            case 'App\Models\Payslip':
                return $query->where('employee_id', $user->id);
            case 'App\Models\Complaint':
                return $query->where(function ($q) use ($user) {
                    $q->where('employee_id', $user->id)
                        ->orWhere('against_employee_id', $user->id);
                });
            case 'App\Models\Asset':
                return $query->join('asset_assignments', 'assets.id', '=', 'asset_assignments.asset_id')
                    ->where('asset_assignments.employee_id', $user->id)
                    ->select('assets.*');
            case 'App\Models\TrainingSession':
                return $query->join('training_session_trainer', 'training_sessions.id', '=', 'training_session_trainer.training_session_id')
                    ->where('training_session_trainer.employee_id', $user->id)
                    ->select('training_sessions.*');
            case 'App\Models\Interview':
                return $query->whereJsonContains('interviewers', (string) $user->id);
            case 'App\Models\CandidateAssessment':
                return $query->where('conducted_by', $user->id);
            case 'App\Models\CandidateOnboarding':
                return $query->where('buddy_employee_id', $user->id);
            case 'App\Models\ContractAmendment':
                return $query->join('employee_contracts', 'employee_contracts.id', '=', 'contract_amendments.contract_id')
                    ->where('employee_contracts.employee_id', $user->id)
                    ->select('contract_amendments.*');
            case 'App\Models\ContractRenewal':
                return $query->join('employee_contracts', 'employee_contracts.id', '=', 'contract_renewals.contract_id')
                    ->where('employee_contracts.employee_id', $user->id)
                    ->select('contract_renewals.*');
            case 'App\Models\HrDocument':
                return $query->whereIn('created_by', getCompanyAndUsersId());
            case 'App\Models\DocumentAcknowledgment':
                return $query->where('user_id', $user->id);
            case 'App\Models\Meeting':
                return $query->where('organizer_id', $user->id);
            case 'App\Models\MeetingAttendee':
                return $query->where('user_id', $user->id);
            case 'App\Models\MeetingMinute':
                return $query->where('recorded_by', $user->id);
            case 'App\Models\ActionItem':
                return $query->where('assigned_to', $user->id);
            default:
                if ($hasManagePermission && $this->hasColumnCached($tableName, 'created_by')) {
                    return $query->whereIn('created_by', getCompanyAndUsersId());
                }
                return $query;
        }
    }
}