<?php

namespace App\Providers;

use App\Models\Applicant;
use App\Models\Expense;
use App\Models\FnfSettlement;
use App\Models\Leave;
use App\Models\Offboarding;
use App\Models\OffboardingChecklistItem;
use App\Models\PerformanceReview;
use App\Models\PrePayment;
use App\Models\Resignation;
use App\Policies\ApplicantPolicy;
use App\Policies\ExpensePolicy;
use App\Policies\FnfSettlementPolicy;
use App\Policies\LeavePolicy;
use App\Policies\OffboardingPolicy;
use App\Policies\PerformanceReviewPolicy;
use App\Policies\PrePaymentPolicy;
use App\Policies\ResignationPolicy;
use Illuminate\Support\Facades\Gate;
use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;

class AuthServiceProvider extends ServiceProvider
{
    protected $policies = [
        Applicant::class => ApplicantPolicy::class,
        Leave::class => LeavePolicy::class,
        Expense::class => ExpensePolicy::class,
        Offboarding::class => OffboardingPolicy::class,
        Resignation::class => ResignationPolicy::class,
        FnfSettlement::class => FnfSettlementPolicy::class,
        PrePayment::class => PrePaymentPolicy::class,
        PerformanceReview::class => PerformanceReviewPolicy::class,
    ];

    public function boot(): void
    {
        $this->registerPolicies();

        Gate::define('updateChecklistItem', [OffboardingPolicy::class, 'updateChecklistItem']);

        // Only platform superadmins and company account admins bypass policies.
        // Tenant role name "admin" must still pass through LeavePolicy / ExpensePolicy / etc.
        // Leave edit/cancel stays owner-only even for account admins.
        Gate::before(function ($user, $ability, $arguments = []) {
            if ($user->isSuperAdmin() || $user->isCompanyAccountAdmin()) {
                if (
                    in_array($ability, ['update', 'delete', 'withdraw'], true)
                    && isset($arguments[0])
                    && $arguments[0] instanceof \App\Models\Leave
                ) {
                    return null;
                }

                return true;
            }

            return null;
        });
    }
}