namespace SwDAL.DTO.UserResourceRole;

// ── Main entity DTO ────────────────────────────────────────────────────────
// Answers "what SQL privilege can this specific user exercise against this specific
// DbServer/ClientDatabase" — a per-resource-instance dimension MenuRights (RoleId+MenuCode,
// module-wide) cannot express. ROLE reuses ClientDbLoginRole (Dba=0/App=1/ReadOnly=2), the
// same vocabulary already used for the three contained SQL logins created per client database.

public class UserResourceRoleDTO
{
    public int     UserResourceRoleId { get; set; }
    public int     UserId             { get; set; }
    public string? UserName           { get; set; }  // read-only JOIN
    public int?    DbServerId         { get; set; }
    public string? HostName           { get; set; }   // read-only JOIN
    public int?    ClientDbId         { get; set; }
    public string? ClientDbCode       { get; set; }    // read-only JOIN
    public byte    Role               { get; set; }    // ClientDbLoginRole: 0=Dba, 1=App, 2=ReadOnly

    // Standard M-table fields
    public byte    Status       { get; set; } = 1;
    public short   SortOrder    { get; set; } = 9999;
    public int     CreatedById  { get; set; }
    public DateTime CreatedOn    { get; set; }
    public int     ModifiedById { get; set; }
    public DateTime ModifiedOn   { get; set; }
    public byte    SourceType   { get; set; } = 5;
    public int     TenantId     { get; set; }
}

// ── Assign/Revoke requests — one DTO parameter per CLAUDE.md's mutation rule ───────────────

public class AssignUserResourceRoleDTO
{
    public int  UserId     { get; set; }
    public int? DbServerId { get; set; }
    public int? ClientDbId { get; set; }
    public byte Role       { get; set; }
}

public class RevokeUserResourceRoleDTO
{
    public int  UserId     { get; set; }
    public int? DbServerId { get; set; }
    public int? ClientDbId { get; set; }
}