using Statum;

namespace Spry.Actions {

	/**
	 * Grants a permission to the user targeted by the sealed private data
	 * ({@link UserActionPrivate}.`user_id`, falling back to the `user_id`
	 * form field when no blob was sent); the permission comes from {@link
	 * UserManagementAction.target_permission}. Idempotent — granting a
	 * permission the user already holds succeeds without duplicating the
	 * row. A missing target user is refused with the failure notification,
	 * so a stale id cannot orphan a permission row. Admin-guarded.
	 */
	public class GrantPermissionAction : UserManagementAction {

		/** Notification shown when no `user_id` was supplied. */
		protected virtual string user_required_message { get { return "A user id is required."; } }

		/** Notification shown when no permission was supplied. */
		protected virtual string permission_required_message { get { return "A permission is required."; } }

		/** Notification shown after a successful grant. */
		protected virtual string permission_granted_message { get { return "Permission granted."; } }

		/** Notification shown when the grant could not be persisted. */
		protected virtual string grant_failed_message { get { return "Could not grant the permission. Please try again later."; } }

		public override async DirectiveBuilder handle() throws GLib.Error {
			var guard = yield require_permission_guard();
			if (guard != null) {
				return (!)guard;
			}

			int64 user_id = target_user_id();
			if (user_id == 0) {
				return directives().notify("error", user_required_message);
			}

			string permission = target_permission();
			if (permission.length == 0) {
				return directives().notify("error", permission_required_message);
			}

			try {
				var target = yield users.get_user(user_id);
				if (target == null) {
					warning("[Spry] grant refused: no user exists with id %d", (int) user_id);
					return directives().notify("error", grant_failed_message);
				}
				yield users.set_user_permission(user_id, permission);
				return directives().notify("success", permission_granted_message);
			} catch (Error e) {
				return directives().notify("error",
					ProfileValidation.internal_error_message(e, grant_failed_message));
			}
		}
	}

}