package authkit

import "strings"

const (
	ScopeUserRead         = "user:read"
	ScopeUserWrite        = "user:write"
	ScopeUserStats        = "user:stats"
	ScopeUserPassword     = "user:password"
	ScopeLoginManage      = "login:manage"
	ScopeLoginRequest     = "login:request"
	ScopeKick             = "kick"
	ScopePlayerDisconnect = "player:disconnect"
	ScopeEventsPublish    = "events:publish"
	ScopeEventsSubscribe  = "events:subscribe"
	ScopeServerRead       = "server:read"
	ScopeServerState      = "server:state"
	ScopeKeysProvision    = "keys:provision"
	ScopeKeysRead         = "keys:read"
)

var defaultScopes = map[string][]string{
	"bot":            {"user:*", "login:manage", "kick", "events:subscribe", "keys:read"},
	"server-manager": {"events:publish", "keys:provision", "keys:read"},
	"portal":         {"user:read", "server:read"},
	"gate-waker":     {"user:read", "server:read"},
	"addon":          {"user:read", "user:stats", "server:read", "player:disconnect", "login:request", "events:subscribe"},
	"mc-wrapper":     {"user:read", "server:read", "server:state", "events:subscribe"},
}

// DefaultScopes returns the canonical scope set for a service, or nil for unknown.
func DefaultScopes(service string) []string {
	s, ok := defaultScopes[service]
	if !ok {
		return nil
	}
	out := make([]string, len(s))
	copy(out, s)
	return out
}

// HasScope reports whether want is satisfied by the scopes slice.
// A granted scope ending in "*" matches any want sharing the same prefix
// (e.g. "user:*" matches "user:read").
func HasScope(scopes []string, want string) bool {
	for _, g := range scopes {
		if g == want {
			return true
		}
		if strings.HasSuffix(g, "*") {
			pfx := g[:len(g)-1]
			if strings.HasPrefix(want, pfx) {
				return true
			}
		}
	}
	return false
}