import type { Access, FieldAccess } from 'payload'

import type { Role } from './types.js'

import { hasMinimumRole, isAdmin } from './predicates.js'

/**
 * Collection-level access (returns boolean | Where).
 * Use in collection `access.read/create/update/delete`.
 */
export const adminOnly: Access = ({ req: { user } }) => isAdmin(user)

export const adminOrEditor: Access = ({ req: { user } }) => hasMinimumRole(user, 'editor')

export const authenticated: Access = ({ req: { user } }) => Boolean(user)

/** Requires at least the given role. */
export const requireRole =
  (minimum: Role): Access =>
  ({ req: { user } }) =>
    hasMinimumRole(user, minimum)

/** Admins see all; others are constrained to their own document. */
export const adminOrSelf: Access = ({ req: { user } }) => {
  if (isAdmin(user)) {return true}
  if (!user) {return false}
  return { id: { equals: user.id } }
}

/**
 * Field-level access (returns boolean only — no Where support).
 * Use in field `access.read/update`.
 */
export const adminOnlyField: FieldAccess = ({ req: { user } }) => isAdmin(user)

export const adminOrEditorField: FieldAccess = ({ req: { user } }) => hasMinimumRole(user, 'editor')

/** Requires at least the given role, for field-level access. */
export const requireRoleField =
  (minimum: Role): FieldAccess =>
  ({ req: { user } }) =>
    hasMinimumRole(user, minimum)