"""NL2SQL 请求级权限快照服务。"""
from __future__ import annotations

from nl2sql.permission import build_query_permission
from model.sys_user import SysUser
from repositories.nl2sql_permission import Nl2SqlPermissionRepo
from repositories.sys_user import SysUserRepo


def _denied_permission(user_id: int) -> dict:
    """构造默认拒绝快照，避免把不存在用户的信息暴露给调用方。"""
    return build_query_permission(
        SysUser(id=user_id, user_type="UNKNOWN", employee_role=None, status="异常"),
        None,
        [],
        [],
        [],
    )


async def load_query_permission(
    db,
    user_id: int,
    *,
    user_repo_factory=SysUserRepo,
    permission_repo_factory=Nl2SqlPermissionRepo,
) -> dict:
    """每次调用重新加载用户和 NL2SQL 权限，返回请求级权限快照。"""
    user = await user_repo_factory(db).get(user_id)
    if user is None or getattr(user, "status", None) != "正常":
        return _denied_permission(user_id)
    if getattr(user, "user_type", None) != "EMPLOYEE":
        return _denied_permission(user_id)

    repo = permission_repo_factory(db)
    role = await repo.get_role_by_employee_role(user.employee_role)
    table_permissions = await repo.list_table_permissions(role.id) if role else []
    column_permissions = await repo.list_column_permissions(role.id) if role else []
    sensitive_fields = await repo.list_sensitive_fields()
    return build_query_permission(
        user,
        role,
        table_permissions,
        column_permissions,
        sensitive_fields,
    )