using Statum;

namespace Spry.Actions {

	/**
	 * Revokes a single permission from the user targeted by the sealed
	 * private data ({@link UserActionPrivate}.`user_id`, falling back to
	 * the `user_id` form field when no blob was sent); the permission
	 * comes from {@link UserManagementAction.target_permission}, and only
	 * the matching rows are removed (the user's remaining permissions are
	 * untouched). A missing target user is refused with the failure
	 * notification rather than reporting an empty revoke as success.
	 * Admin-guarded.
	 */
	public class RevokePermissionAction : UserManagementAction {

		/** Notification shown when no `user_id` was supplied. */
		protected virtual string user_required_message { get { return "A user id is required."; } }

		/** Notification shown when no permission was supplied. */
		protected virtual string permission_required_message { get { return "A permission is required."; } }

		/** Notification shown after a successful revoke. */
		protected virtual string permission_revoked_message { get { return "Permission revoked."; } }

		/** Notification shown when the revoke could not be persisted. */
		protected virtual string revoke_failed_message { get { return "Could not revoke the permission. Please try again later."; } }

		public override async DirectiveBuilder handle() throws GLib.Error {
			var guard = yield require_permission_guard();
			if (guard != null) {
				return (!)guard;
			}

			int64 user_id = target_user_id();
			if (user_id == 0) {
				return directives().notify("error", user_required_message);
			}

			string permission = target_permission();
			if (permission.length == 0) {
				return directives().notify("error", permission_required_message);
			}

			try {
				var target = yield users.get_user(user_id);
				if (target == null) {
					warning("[Spry] revoke refused: no user exists with id %d", (int) user_id);
					return directives().notify("error", revoke_failed_message);
				}
				yield users.remove_user_permission(user_id, permission);
				return directives().notify("success", permission_revoked_message);
			} catch (Error e) {
				return directives().notify("error",
					ProfileValidation.internal_error_message(e, revoke_failed_message));
			}
		}
	}

}