import type { Permission } from "@/generated/prisma/enums";
import { hasPermission } from "@/lib/auth/permissions";

/**
 * Per-action owner permission checks — the mirror of
 * src/features/staff/authorization.ts and src/features/booking/authorization.ts.
 * The `(owner)` route group layout already gates on MANAGE_STAFF as a
 * coarse "is this person any kind of owner" shell check, but that is not
 * enough on its own (see docs/phase-6-summary.md, "Permission and
 * business-isolation rules") — every owner Server Action re-derives the
 * session and checks the *specific* permission that action needs, since a
 * future non-Owner role could plausibly hold some but not all of these.
 */

export class OwnerPermissionDeniedError extends Error {
  constructor(message = "You don't have permission to do that.") {
    super(message);
    this.name = "OwnerPermissionDeniedError";
  }
}

export async function assertOwnerPermission(userId: string, permission: Permission): Promise<void> {
  const allowed = await hasPermission(userId, permission);
  if (!allowed) throw new OwnerPermissionDeniedError();
}