<?php

declare(strict_types=1);

namespace MageSail\Magesail\Setup\Patch\Data;

use Magento\Framework\Setup\ModuleDataSetupInterface;
use Magento\Framework\Setup\Patch\DataPatchInterface;

/**
 * Grants menu + granular tunnel ACL for roles that had legacy tunnel or config resources.
 */
class GrantMagesailMenuAcl implements DataPatchInterface
{
    public function __construct(
        private readonly ModuleDataSetupInterface $moduleDataSetup
    ) {
    }

    public function apply(): void
    {
        $conn = $this->moduleDataSetup->getConnection();
        $table = $this->moduleDataSetup->getTable('authorization_rule');
        if (!$conn->isTableExists($table)) {
            return;
        }
        $describe = $conn->describeTable($table);
        $allowField = isset($describe['permissions']) ? 'permissions' : (isset($describe['permission']) ? 'permission' : null);
        if ($allowField === null) {
            return;
        }
        $legacyResources = ['MageSail_Magesail::tunnel', 'MageSail_Magesail::config'];
        $select = $conn->select()
            ->from($table, ['role_id'])
            ->where('resource_id IN (?)', $legacyResources)
            ->where($allowField . ' = ?', 'allow');
        $roleIds = array_unique(array_map('intval', $conn->fetchCol($select)));
        foreach ($roleIds as $roleId) {
            $this->insertRuleIfMissing($conn, $table, $roleId, 'MageSail_Magesail::magesail');
        }
        $tunnelSelect = $conn->select()
            ->from($table, ['role_id'])
            ->where('resource_id = ?', 'MageSail_Magesail::tunnel')
            ->where($allowField . ' = ?', 'allow');
        foreach (array_unique(array_map('intval', $conn->fetchCol($tunnelSelect))) as $roleId) {
            $this->insertRuleIfMissing($conn, $table, $roleId, 'MageSail_Magesail::tunnel_view');
            $this->insertRuleIfMissing($conn, $table, $roleId, 'MageSail_Magesail::tunnel_manage');
        }
    }

    private function insertRuleIfMissing(
        \Magento\Framework\DB\Adapter\AdapterInterface $conn,
        string $table,
        int $roleId,
        string $resourceId
    ): void {
        $exists = (int) $conn->fetchOne(
            $conn->select()
                ->from($table, ['c' => new \Zend_Db_Expr('COUNT(*)')])
                ->where('role_id = ?', $roleId)
                ->where('resource_id = ?', $resourceId)
        );
        if ($exists > 0) {
            return;
        }
        $row = [
            'role_id' => $roleId,
            'resource_id' => $resourceId,
        ];
        $describe = $conn->describeTable($table);
        if (isset($describe['permissions'])) {
            $row['permissions'] = 'allow';
        } elseif (isset($describe['permission'])) {
            $row['permission'] = 'allow';
        } else {
            return;
        }
        if (isset($describe['privileges'])) {
            $row['privileges'] = '';
        }
        $conn->insert($table, $row);
    }

    public static function getDependencies(): array
    {
        return [];
    }

    public function getAliases(): array
    {
        return [];
    }
}