from __future__ import annotations

from fastapi import APIRouter, Body, Request
from typing import Any

from app.api.v1.endpoints.platform import ok, fail
from app.db.platform_store import get_platform_store

router = APIRouter(prefix="/resources", tags=["resource"])


def _actor(request: Request) -> str | None:
    auth = request.headers.get("Authorization", "")
    token = auth.replace("Bearer ", "").strip()
    return token or None


@router.get("/{resource_type}/{resource_id}/acl")
def get_acl(resource_type: str, resource_id: str) -> dict[str, Any]:
    """查询资源 ACL，返回按主体分组的权限列表。"""
    return ok(get_platform_store().resource_acl(resource_type, resource_id))


@router.put("/{resource_type}/{resource_id}/acl")
def set_acl(
    resource_type: str,
    resource_id: str,
    payload: dict[str, Any] = Body(...),
    request: Request = None,
) -> dict[str, Any]:
    """设置资源 ACL，body: { entries: [{ subject_type, subject_id, permissions: [] }] }"""
    entries = payload.get("entries") or []
    result = get_platform_store().set_resource_acl(resource_type, resource_id, entries)
    get_platform_store().record_audit(
        action="resource.acl.set",
        actor_id=_actor(request) if request else None,
        target_type=resource_type,
        target_id=resource_id,
        detail=f"entries={len(entries)}",
    )
    return ok(result)