using System.Security.Claims;
using Tiku.Application.Security;
using Tiku.Domain.Tenancy;

namespace Tiku.Api.Security;

internal static class TenantRoleAuthorization
{
    private static readonly HashSet<string> AdminRoles = new(StringComparer.Ordinal)
    {
        TenantRole.PlatformAdmin.ToString(),
        TenantRole.TenantOwner.ToString(),
        TenantRole.TenantAdmin.ToString()
    };

    public static bool IsTenantMember(ClaimsPrincipal principal)
    {
        return principal.Identity?.IsAuthenticated == true &&
               principal.HasClaim(claim => claim.Type == TikuClaimTypes.TenantId);
    }

    public static bool IsTenantAdmin(ClaimsPrincipal principal)
    {
        return IsTenantMember(principal) &&
               principal.Claims
                   .Where(claim => claim.Type == TikuClaimTypes.TenantRole)
                   .Select(claim => claim.Value)
                   .Any(role => AdminRoles.Contains(role));
    }
}