/**
 * UserAccessOverride Model
 *
 * Per-user permission overrides that take priority over role permissions.
 * Grants add permissions on top of the user's role.
 * Denies remove permissions from the user's role.
 *
 * Resolution order: Super Admin → User-specific deny → User-specific grant → Role permission → Default (none)
 */

import mongoose, { Schema, Document } from 'mongoose';
import { IPermission } from './Role';

// Reuse the Permission sub-schema structure
const AccessPermissionSchema = new Schema({
  module: { type: String, required: true, trim: true },
  page: { type: String, trim: true },
  feature: { type: String, trim: true },
  actions: [{ type: String, trim: true }],
}, { _id: false });

export interface IUserAccessOverride extends Document {
  userId: mongoose.Types.ObjectId;
  companyId: string;
  grants: IPermission[];
  denies: IPermission[];
  createdAt: Date;
  updatedAt: Date;
}

const UserAccessOverrideSchema = new Schema<IUserAccessOverride>({
  userId: {
    type: Schema.Types.ObjectId,
    ref: 'User',
    required: [true, 'User ID is required'],
    index: true,
  },
  companyId: {
    type: String,
    required: [true, 'Company ID is required'],
    index: true,
  },
  grants: [AccessPermissionSchema],
  denies: [AccessPermissionSchema],
}, {
  timestamps: true,
});

// One override document per user per company
UserAccessOverrideSchema.index({ userId: 1, companyId: 1 }, { unique: true });

export const UserAccessOverride = mongoose.models.UserAccessOverride || mongoose.model<IUserAccessOverride>('UserAccessOverride', UserAccessOverrideSchema);