<?php

declare(strict_types=1);

use App\Models\FormBuilder\FormSubmission;
use App\Models\Organisation;
use App\Models\User;
use Illuminate\Support\Facades\Broadcast;

/*
|--------------------------------------------------------------------------
| Broadcast Channel Authorization
|--------------------------------------------------------------------------
|
| Channel-level authorization callbacks for private and presence channels.
| Laravel's broadcasting auth middleware invokes these on subscription
| attempts; returning truthy authorises, falsy denies.
|
| File registered in bootstrap/app.php via withRouting(channels: ...).
| Without that registration this file is dead code.
|
*/

/*
 * Per RFC-WS-6 §Q1 v1.3 addition 2.
 *
 * Authorises private subscriptions to a form-submission's identity-match
 * resolution channel. The TriggerPersonIdentityMatchOnFormSubmit listener
 * dispatches FormSubmissionIdentityMatchResolved on this channel after
 * writing the final identity_match_status; the frontend portal
 * IdentityMatchBanner subscribes via Echo.private('submission.{id}') and
 * refetches the submission resource on receipt.
 *
 * Authorisation paths (in order of cheap-first short-circuit):
 *   1. Submitter (submitted_by_user_id === user.id) — common case for the
 *      portal banner; no DB lookup beyond the submission itself.
 *   2. super_admin (Spatie HasRoles, app-wide bypass) — debugging,
 *      impersonation, platform-level support.
 *   3. Organisation admin of the submission's organisation — pivot-table
 *      check on user_organisation with role='org_admin'. Codebase
 *      canonical pattern, mirroring FormSubmissionActionFailurePolicy::canAccess
 *      (Spatie teams is disabled in config/permission.php; org-scoping
 *      lives in the pivot, not in Spatie).
 *
 * Public (token-based) submitters are not on this channel; their flow is
 * polling-based and they don't have a User to authenticate with.
 */
Broadcast::channel(
    'submission.{submissionId}',
    function (User $user, string $submissionId): bool {
        $submission = FormSubmission::query()
            ->withoutGlobalScopes()
            ->find($submissionId);

        if ($submission === null) {
            return false;
        }

        // Submitter has access (authenticated session at submit time).
        if ($submission->submitted_by_user_id === $user->id) {
            return true;
        }

        // super_admin app-wide bypass (Spatie HasRoles, global role).
        if ($user->hasRole('super_admin')) {
            return true;
        }

        // Org admins of the submission's organisation. Pivot-table check
        // matching the codebase's canonical pattern (see e.g.
        // FormSubmissionActionFailurePolicy::canAccess). Spatie teams is
        // disabled in config/permission.php, so org-scoping lives in the
        // user_organisation pivot's `role` column, not Spatie.
        $organisation = Organisation::query()
            ->withoutGlobalScopes()
            ->find($submission->organisation_id);

        if (! $organisation instanceof Organisation) {
            return false;
        }

        return $organisation->users()
            ->where('user_id', $user->id)
            ->wherePivot('role', 'org_admin')
            ->exists();
    },
);