import { useQuery } from "@tanstack/react-query";
import { supabase } from "@/integrations/supabase/client";
import type { Database } from "@/integrations/supabase/types";

export type AppRole = Database["public"]["Enums"]["app_role"];

export function useRoles() {
  const q = useQuery({
    queryKey: ["my-roles"],
    staleTime: 60_000,
    queryFn: async (): Promise<AppRole[]> => {
      const { data: u } = await supabase.auth.getUser();
      if (!u.user) return [];
      const { data, error } = await supabase
        .from("user_roles")
        .select("role")
        .eq("user_id", u.user.id);
      if (error) throw error;
      return (data ?? []).map((r) => r.role as AppRole);
    },
  });
  const roles = q.data ?? [];
  const has = (r: AppRole) => roles.includes(r);
  const hasAny = (rs: AppRole[]) => rs.some((r) => roles.includes(r));
  const isAdmin = hasAny(["super_admin", "admin", "company_admin"]);
  const isOps = hasAny(["super_admin", "admin", "company_admin", "ops_manager"]);
  const isSupervisor = hasAny([
    "super_admin", "admin", "company_admin", "ops_manager", "supervisor", "security_officer",
  ]);
  return { roles, has, hasAny, isAdmin, isOps, isSupervisor, isLoading: q.isLoading };
}

export function RequireRole({
  any,
  children,
  fallback,
}: {
  any: AppRole[];
  children: React.ReactNode;
  fallback?: React.ReactNode;
}) {
  const { hasAny, isLoading } = useRoles();
  if (isLoading) return null;
  if (!hasAny(any)) {
    return (
      fallback ?? (
        <div className="rounded-md border border-destructive/30 bg-destructive/5 p-6 text-center">
          <p className="font-medium">Access denied</p>
          <p className="text-sm text-muted-foreground mt-1">
            You don't have permission to view this section.
          </p>
        </div>
      )
    );
  }
  return <>{children}</>;
}