using Microsoft.AspNetCore.Authorization;
using System.Security.Claims;

namespace Ladaer.BackEnd.Infrastructures.Authorization
{
    /// <summary>
    /// Custom Authorization Handler cho phAcp Founder bypass t���t c��� role checks
    /// </summary>
    public class FounderBypassAuthorizationHandler : IAuthorizationHandler
    {
        private readonly ILogger<FounderBypassAuthorizationHandler> _logger;

        public FounderBypassAuthorizationHandler(ILogger<FounderBypassAuthorizationHandler> logger)
        {
            _logger = logger;
        }

        public Task HandleAsync(AuthorizationHandlerContext context)
        {
            // Ki���m tra n���u user �`A� authenticated
            if (!context.User.Identity?.IsAuthenticated ?? true)
            {
                return Task.CompletedTask;
            }

            // Ki���m tra n���u user cA3 role "Founder"
            if (context.User.IsInRole("Founder"))
            {
                _logger.LogInformation("Founder access granted for user: {UserId} to resource: {Resource}", 
                    context.User.FindFirst(ClaimTypes.NameIdentifier)?.Value,
                    context.Resource?.ToString() ?? "Unknown");

                // Founder �`�����c phAcp truy c��-p t���t c��� - mark t���t c��� requirements lA� succeeded
                foreach (var requirement in context.Requirements)
                {
                    if (!context.HasSucceeded)
                    {
                        context.Succeed(requirement);
                    }
                }
            }

            return Task.CompletedTask;
        }
    }
}