import type { Access, FieldAccess } from "payload";

/**
 * Only the "users" auth collection (Anna/admins) may perform the action —
 * and only with the "admin" role, so adding further roles to Users later
 * only means extending this one check. Site visitors authenticate against
 * the separate "customers" collection (see collections/Customers.ts) and
 * must never be treated as admins here.
 */
export const isAdmin: Access = ({ req: { user } }) =>
  user?.collection === "users" && user.role === "admin";

export const isAdminFieldLevel: FieldAccess = ({ req: { user } }) =>
  user?.collection === "users" && user.role === "admin";

/**
 * Admins always see Analytics; any other "users" account additionally needs
 * its own `canViewAnalytics` flag (see collections/Users.ts) — this is the
 * granular permission the single "admin" role doesn't otherwise provide.
 * Used both as a Payload Access/FieldAccess function and called directly
 * (with a minimal `{ req: { user } }` shape) from the custom admin nav-link
 * and view components, which Payload does not gate via collection access.
 */
export const canViewAnalytics: Access = ({ req: { user } }) =>
  user?.collection === "users" && (user.role === "admin" || user.canViewAnalytics === true);

/**
 * Admins can read every document (including drafts); everyone else may only
 * read documents whose Payload draft/publish status is "published".
 */
export const publishedOrAdmin: Access = ({ req: { user } }) => {
  if (user?.collection === "users" && user.role === "admin") return true;

  return {
    _status: { equals: "published" },
  };
};