package middleware

import (
    "net/http"
    "github.com/gin-gonic/gin"
)

// RequireRole checks if user has required role
func RequireRole(requiredRole string) gin.HandlerFunc {
    return func(c *gin.Context) {
        // Get user role from JWT token or session
        userRole, exists := c.Get("userRole")
        if !exists {
            c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
            c.Abort()
            return
        }

        if userRole.(string) != requiredRole {
            c.JSON(http.StatusForbidden, gin.H{"error": "Insufficient permissions"})
            c.Abort()
            return
        }

        c.Next()
    }
}

// Usage in routes
func SetupRoutes(r *gin.Engine) {
    // Public routes
    r.GET("/api/products", GetProducts)
    
    // User routes (requires authentication)
    userGroup := r.Group("/api/user")
    userGroup.Use(AuthRequired())
    {
        userGroup.GET("/profile", GetUserProfile)
        userGroup.PUT("/profile", UpdateUserProfile)
    }
    
    // Admin routes (requires admin role)
    adminGroup := r.Group("/api/admin")
    adminGroup.Use(AuthRequired(), RequireRole("admin"))
    {
        adminGroup.DELETE("/users/:id", DeleteUser)
        adminGroup.GET("/stats", GetSystemStats)
    }
}

// GetOrderDetail ensures user can only access their own orders
func GetOrderDetail(c *gin.Context) {
    orderID := c.Param("id")
    
    // Get current user ID from token
    currentUserID, _ := c.Get("userID")
    
    // Query order from database
    var order Order
    if err := db.Where("id = ?", orderID).First(&order).Error; err != nil {
        c.JSON(http.StatusNotFound, gin.H{"error": "Order not found"})
        return
    }
    
    // Critical: Verify ownership before returning data
    if order.UserID != currentUserID.(uint) {
        c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
        return
    }
    
    c.JSON(http.StatusOK, order)
}

package rbac

import "github.com/gin-gonic/gin"

type Permission string

const (
    PermReadUser   Permission = "user:read"
    PermWriteUser  Permission = "user:write"
    PermDeleteUser Permission = "user:delete"
    PermReadAdmin  Permission = "admin:read"
)

var RolePermissions = map[string][]Permission{
    "user": {
        PermReadUser,
        PermWriteUser,
    },
    "admin": {
        PermReadUser,
        PermWriteUser,
        PermDeleteUser,
        PermReadAdmin,
    },
}

func RequirePermission(required Permission) gin.HandlerFunc {
    return func(c *gin.Context) {
        userRole, _ := c.Get("userRole")
        permissions := RolePermissions[userRole.(string)]
        
        hasPermission := false
        for _, perm := range permissions {
            if perm == required {
                hasPermission = true
                break
            }
        }
        
        if !hasPermission {
            c.JSON(403, gin.H{"error": "Permission denied"})
            c.Abort()
            return
        }
        
        c.Next()
    }
}

import "github.com/google/uuid"

// Create order with UUID
func CreateOrder(c *gin.Context) {
    order := Order{
        UUID:   uuid.New().String(),  // Use UUID instead of auto-increment ID
        UserID: getCurrentUserID(c),
        // ... other fields
    }
    
    db.Create(&order)
    c.JSON(200, gin.H{"orderUUID": order.UUID})
}

// Access order by UUID
func GetOrder(c *gin.Context) {
    orderUUID := c.Param("uuid")
    
    var order Order
    if err := db.Where("uuid = ? AND user_id = ?", 
        orderUUID, getCurrentUserID(c)).First(&order).Error; err != nil {
        c.JSON(404, gin.H{"error": "Order not found"})
        return
    }
    
    c.JSON(200, order)
}

func AccessLogger() gin.HandlerFunc {
    return func(c *gin.Context) {
        userID, _ := c.Get("userID")
        
        // Log access attempt
        log.Printf("Access: User=%v, Method=%s, Path=%s, IP=%s",
            userID, c.Request.Method, c.Request.URL.Path, c.ClientIP())
        
        c.Next()
        
        // Log failed authorization attempts
        if c.Writer.Status() == http.StatusForbidden {
            log.Printf("SECURITY: Unauthorized access attempt - User=%v, Path=%s",
                userID, c.Request.URL.Path)
            
            // Trigger alert if too many failures
            checkAndAlertAnomalousActivity(userID, c.Request.URL.Path)
        }
    }
}