<?php

/** Club permissions are looked up on each request, never trusted from form fields. */
class TenantAccess extends Base {

    public const SUPER = 'Super System Administrator';

    public function isSuper(?PDO $db = null, ?int $user = null): bool {
        $stmt = ($db ?? $this->connect())->prepare("SELECT 1 FROM users WHERE user_serial=? AND user_role=? AND user_status='active' LOCK IN SHARE MODE");
        $stmt->execute([$user ?? ($_SESSION[self::USER_SERIAL] ?? 0), self::SUPER]);
        return (bool) $stmt->fetchColumn();
    }

    public function requireSuper(?PDO $db = null): void {
        if (!$this->isSuper($db))
            throw new AppException('Only a Super System Administrator may manage global accounts and settings.', 403);
    }

    public function canManage(int $club, ?PDO $db = null, ?int $user = null): bool {
        $db ??= $this->connect();
        $user ??= (int) ($_SESSION[self::USER_SERIAL] ?? 0);
        if ($this->isSuper($db, $user))
            return true;
        $stmt = $db->prepare("SELECT 1 FROM club_memberships m JOIN users u ON u.user_serial=m.user_serial WHERE m.club_serial=? AND m.user_serial=? AND m.membership_role='administrator' AND m.membership_status='active' AND u.user_status='active' AND u.user_email_verified_at IS NOT NULL LOCK IN SHARE MODE");
        $stmt->execute([$club, $user]);
        return (bool) $stmt->fetchColumn();
    }

    public function available(): bool {
        return (bool) $this->connect()->query("SELECT COUNT(*) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME='club_memberships' AND COLUMN_NAME='membership_role'")->fetchColumn();
    }

    public function managesAny(): bool {
        if ($this->isSuper())
            return true;
        if (!$this->available())
            return false;
        $stmt = $this->connect()->prepare("SELECT 1 FROM club_memberships m JOIN users u ON u.user_serial=m.user_serial WHERE m.user_serial=? AND m.membership_role='administrator' AND m.membership_status='active' AND u.user_status='active' AND u.user_email_verified_at IS NOT NULL LIMIT 1");
        $stmt->execute([$_SESSION[self::USER_SERIAL] ?? 0]);
        return (bool) $stmt->fetchColumn();
    }

    public function requireManager(int $club, ?PDO $db = null): void {
        if (!$this->canManage($club, $db))
            throw new AppException('You cannot manage this club.', 403);
    }
}