<?php
require_once __DIR__ . '/BaseModel.php';

/**
 * Role-Based Access Control Class
 * Handles permissions and role management
 */
class RBAC {
    private $db;
    
    public function __construct() {
        $this->db = Database::getInstance();
    }
    
    /**
     * Check if user has permission
     */
    public function hasPermission($userId, $permissionName) {
        $sql = "SELECT COUNT(*) as has_permission 
                FROM role_permissions rp 
                INNER JOIN permissions p ON rp.permission_id = p.id 
                INNER JOIN users u ON u.role_id = rp.role_id 
                WHERE u.id = ? AND p.permission_name = ?";
        
        $result = $this->db->query($sql, [$userId, $permissionName]);
        $row = $result->fetch_assoc();
        
        return (int)$row['has_permission'] > 0;
    }
    
    /**
     * Get all permissions for a user
     */
    public function getUserPermissions($userId) {
        $sql = "SELECT p.permission_name, p.group_name 
                FROM role_permissions rp 
                INNER JOIN permissions p ON rp.permission_id = p.id 
                INNER JOIN users u ON u.role_id = rp.role_id 
                WHERE u.id = ?";
        
        $result = $this->db->query($sql, [$userId]);
        $permissions = [];
        
        while ($row = $result->fetch_assoc()) {
            $permissions[] = $row['permission_name'];
        }
        
        return $permissions;
    }
    
    /**
     * Get role permissions
     */
    public function getRolePermissions($roleId) {
        $sql = "SELECT p.* FROM permissions p 
                INNER JOIN role_permissions rp ON p.id = rp.permission_id 
                WHERE rp.role_id = ?";
        
        $result = $this->db->query($sql, [$roleId]);
        $permissions = [];
        
        while ($row = $result->fetch_assoc()) {
            $permissions[] = $row;
        }
        
        return $permissions;
    }
    
    /**
     * Assign permission to role
     */
    public function assignPermissionToRole($roleId, $permissionId) {
        $sql = "INSERT IGNORE INTO role_permissions (role_id, permission_id) VALUES (?, ?)";
        return $this->db->execute($sql, [$roleId, $permissionId]);
    }
    
    /**
     * Remove permission from role
     */
    public function removePermissionFromRole($roleId, $permissionId) {
        $sql = "DELETE FROM role_permissions WHERE role_id = ? AND permission_id = ?";
        return $this->db->execute($sql, [$roleId, $permissionId]);
    }
    
    /**
     * Create role
     */
    public function createRole($roleName, $description = null) {
        $sql = "INSERT INTO roles (role_name, description) VALUES (?, ?)";
        $this->db->execute($sql, [$roleName, $description]);
        return $this->db->getLastInsertId();
    }
    
    /**
     * Create permission
     */
    public function createPermission($permissionName, $groupName = null) {
        $sql = "INSERT INTO permissions (permission_name, group_name) VALUES (?, ?)";
        $this->db->execute($sql, [$permissionName, $groupName]);
        return $this->db->getLastInsertId();
    }
}
?>
