<?php

declare(strict_types=1);

namespace Plugin\tnt_mcp\src\Mcp\Settings;

use JTL\Backend\Permissions;

/**
 * Which backend permission a merchant needs to change a given shop setting.
 *
 * Mirrors `ConfigController::getPermissionForSection()` (includes/src/Router/Controller/Backend/
 * ConfigController.php:234) — `set_setting` replays that controller's save, so it has to demand the
 * same right the controller's own page demands. Without this the tool was the plugin's one write
 * path with no permission check at all: an admin whose group only holds, say, order-view rights
 * could authorise a connector and reconfigure the shop through it.
 *
 * Where the shop's map returns null it *skips* the check; we do the opposite and fall back to
 * {@see Permissions::SETTINGS_GLOBAL_VIEW}. The shop can afford to skip because the surrounding page
 * was already permission-gated; an MCP call has no such page.
 */
final class SettingsPermissions
{
    /** Demanded for any setting whose section the shop does not map to a specific right. */
    public const FALLBACK = Permissions::SETTINGS_GLOBAL_VIEW;

    public static function forRow(SettingRow $row): string
    {
        return $row->conf === null ? self::FALLBACK : self::forSection($row->conf->section);
    }

    public static function forSection(int $section): string
    {
        return match ($section) {
            -1                       => Permissions::SETTINGS_SEARCH_VIEW,
            \CONF_GLOBAL             => Permissions::SETTINGS_GLOBAL_VIEW,
            \CONF_STARTSEITE         => Permissions::SETTINGS_STARTPAGE_VIEW,
            \CONF_EMAILS             => Permissions::SETTINGS_EMAILS_VIEW,
            \CONF_ARTIKELUEBERSICHT  => Permissions::SETTINGS_ARTICLEOVERVIEW_VIEW,
            \CONF_ARTIKELDETAILS     => Permissions::SETTINGS_ARTICLEDETAILS_VIEW,
            \CONF_KUNDEN             => Permissions::SETTINGS_CUSTOMERFORM_VIEW,
            \CONF_KAUFABWICKLUNG     => Permissions::SETTINGS_BASKET_VIEW,
            \CONF_BOXEN              => Permissions::SETTINGS_BOXES_VIEW,
            default                  => self::FALLBACK,
        };
    }
}
