using GB5Shared.DTO.Framework.Login;
using SwDAL.DTO.UserResourceRole;
using SwDAL.Enums;

namespace SwBLL.UserResourceRole;

public interface IUserResourceRoleBLL
{
    Task<IEnumerable<UserResourceRoleDTO>> GetGrantsForUser(int userId, LoginDTO loginDTO, CancellationToken ct);
    Task<IEnumerable<UserResourceRoleDTO>> GetGranteesForServer(int dbServerId, LoginDTO loginDTO, CancellationToken ct);
    Task<IEnumerable<UserResourceRoleDTO>> GetGranteesForClientDb(int clientDbId, LoginDTO loginDTO, CancellationToken ct);

    /// <summary>The one reusable authorization primitive every enforcement call site uses.
    /// Returns null when no grant is configured for this user against this resource — callers
    /// decide for themselves whether "no grant" means fail-open or fail-closed; this method
    /// never assumes a default. Never cached — a stale grant is a security bug, not a UX
    /// inconvenience.</summary>
    Task<ClientDbLoginRole?> GetEffectiveRole(int userId, int? dbServerId, int? clientDbId, LoginDTO loginDTO, CancellationToken ct);

    Task<string> AssignUserResourceRole(AssignUserResourceRoleDTO dto, LoginDTO loginDTO, CancellationToken ct);
    Task<string> RevokeUserResourceRole(RevokeUserResourceRoleDTO dto, LoginDTO loginDTO, CancellationToken ct);
}