<?php

namespace App\Policies;

use App\Models\AuditLibrary\CompletedAudit;
use App\Models\Core\User;

class CompletedAuditPolicy
{
    /**
     * Determine whether the user can view any completed audits.
     */
    public function viewAny(User $user): bool
    {
        // Both admins and clients can view the list
        // The list will be scoped appropriately
        return true;
    }

    /**
     * Determine whether the user can view the completed audit.
     */
    public function view(User $user, CompletedAudit $audit): bool
    {
        if ($user->isAdmin()) {
            return true;
        }

        // Client users can only see client_visible audits for their clients
        if (! $audit->client_visible) {
            return false;
        }

        return $user->belongsToClient($audit->client);
    }

    /**
     * Determine whether the user can create completed audits.
     */
    public function create(User $user): bool
    {
        return $user->isAdmin();
    }

    /**
     * Determine whether the user can update the completed audit.
     */
    public function update(User $user, CompletedAudit $audit): bool
    {
        if (! $user->isAdmin()) {
            return false;
        }

        // Can only update if audit is still editable
        return $audit->is_editable;
    }

    /**
     * Determine whether the user can mutate the audit through the
     * state machine or finding-update endpoints. Admin-only — the
     * editability check is delegated to CompletedAuditOrchestrator
     * (AUDIT_LOCKED) and the state-machine methods on CompletedAudit
     * (INVALID_STATE_TRANSITION 409), so a more specific error code
     * surfaces than the generic FORBIDDEN.
     */
    public function mutate(User $user, CompletedAudit $audit): bool
    {
        return $user->isAdmin();
    }

    /**
     * Determine whether the user can delete the completed audit.
     */
    public function delete(User $user, CompletedAudit $audit): bool
    {
        return $user->isAdmin();
    }

    /**
     * Determine whether the user can restore the completed audit.
     */
    public function restore(User $user, CompletedAudit $audit): bool
    {
        return $user->isAdmin();
    }

    /**
     * Determine whether the user can permanently delete the completed audit.
     */
    public function forceDelete(User $user, CompletedAudit $audit): bool
    {
        return $user->isAdmin();
    }

    /**
     * Determine whether the user can make the audit visible to clients.
     */
    public function makeVisible(User $user, CompletedAudit $audit): bool
    {
        return $user->isAdmin();
    }

    /**
     * Determine whether the user can hide the audit from clients.
     */
    public function hideFromClient(User $user, CompletedAudit $audit): bool
    {
        return $user->isAdmin();
    }

    /**
     * Determine whether the user can export the completed audit.
     */
    public function export(User $user, CompletedAudit $audit): bool
    {
        if ($user->isAdmin()) {
            return true;
        }

        // Clients can export visible audits for their clients
        return $audit->client_visible && $user->belongsToClient($audit->client);
    }

    /**
     * Determine whether the user can complete/finalize the audit.
     */
    public function complete(User $user, CompletedAudit $audit): bool
    {
        return $user->isAdmin() && $audit->is_editable;
    }

    /**
     * Determine whether the user can cancel the audit.
     */
    public function cancel(User $user, CompletedAudit $audit): bool
    {
        return $user->isAdmin() && $audit->is_editable;
    }

    /**
     * Determine whether the user can archive the audit.
     */
    public function archive(User $user, CompletedAudit $audit): bool
    {
        return $user->isAdmin() && $audit->is_complete;
    }
}