"use server";

import { asc } from "drizzle-orm";
import { requirePermission } from "@/lib/admin/guard";
import { db, WebsiteHousekeepingPermissions } from "@/lib/db";
import { redirectSafe } from "@/lib/foundation/security";
import { PERMS } from "@/lib/permissions";

/**
 * Housekeeping table writes are retired. Runtime access uses ACL only.
 * Redirect editors to live Permissions.
 */
async function rejectLegacyHousekeepingWrite(): Promise<never> {
	await requirePermission(PERMS.SETTINGS_EDIT);
	return redirectSafe(
		"/admin/permissions?from=housekeeping",
		"/admin/permissions",
	);
}

export async function upsertPermission(_formData: FormData): Promise<void> {
	return rejectLegacyHousekeepingWrite();
}

export async function deletePermission(_formData: FormData): Promise<void> {
	return rejectLegacyHousekeepingWrite();
}

export async function bulkImportPermissions(
	_formData: FormData,
): Promise<{ count: number; errors: string[] }> {
	return rejectLegacyHousekeepingWrite();
}

export async function exportPermissions(): Promise<string> {
	await requirePermission(PERMS.SETTINGS_VIEW);

	const perms = await db
		.select({
			permission: WebsiteHousekeepingPermissions.permission,
			minRank: WebsiteHousekeepingPermissions.minRank,
			description: WebsiteHousekeepingPermissions.description,
			groupName: WebsiteHousekeepingPermissions.groupName,
			dependsOn: WebsiteHousekeepingPermissions.dependsOn,
		})
		.from(WebsiteHousekeepingPermissions)
		.orderBy(
			asc(WebsiteHousekeepingPermissions.groupName),
			asc(WebsiteHousekeepingPermissions.permission),
		);

	return JSON.stringify(perms, null, 2);
}

export async function applyPreset(_formData: FormData): Promise<void> {
	return rejectLegacyHousekeepingWrite();
}

export async function clearAllPermissions(): Promise<void> {
	return rejectLegacyHousekeepingWrite();
}

export async function bulkDeletePermissions(
	_ids: bigint[],
): Promise<{ count: number }> {
	return rejectLegacyHousekeepingWrite();
}