package databricks

import (
	"cmp"
	"context"
	"errors"
	"slices"
	"strings"

	"github.com/databricks/databricks-sdk-go/apierr"
	"github.com/databricks/databricks-sdk-go/service/workspace"

	"git.kebcloud.no/keb/lazysecrets/internal/provider"
)

// Details are who has access to a scope, and how much. Only the scope's
// managers may see that; to others it says so.
func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provider.Attr, error) {
	w, pr, err := p.client(c.Source.ID)
	if err != nil {
		return nil, err
	}
	acls, err := w.ListAclsAll(ctx, workspace.ListAclsRequest{Scope: c.Name})
	var api *apierr.APIError
	switch {
	case errors.As(err, &api) && api.StatusCode == 403:
		return []provider.Attr{{Label: "access", Value: "only the scope's managers can see who has it"}}, nil
	case err != nil:
		return nil, classify(pr, err)
	case len(acls) == 0:
		return []provider.Attr{{Label: "access", Value: "workspace admins only"}}, nil
	}
	rank := map[workspace.AclPermission]int{workspace.AclPermissionManage: 0, workspace.AclPermissionWrite: 1, workspace.AclPermissionRead: 2}
	slices.SortFunc(acls, func(a, b workspace.AclItem) int {
		return cmp.Or(cmp.Compare(rank[a.Permission], rank[b.Permission]), cmp.Compare(a.Principal, b.Principal))
	})
	out := make([]provider.Attr, len(acls))
	for i, a := range acls {
		out[i] = provider.Attr{Value: a.Principal + " · " + strings.ToLower(string(a.Permission))}
	}
	out[0].Label = "access"
	return out, nil
}