Ranks and Permissions

# frozen_string_literal: true

# The guild hall. Who you are comes from the connection, your rank from the
# database, and everything you may do from the Pundit policies, asked once
# per tab and per change, with that tab's own viewer. Each tab renders its
# own hall, so an officer and a recruit looking at the same coffer see
# different buttons, and a promotion changes the buttons of the one tab
# that was promoted.
#
# The buttons are only the half you see. Every action asks the policy
# again, with the rank as the database has it now, and a refused one says
# why.
class Recipes::Permissions::GuildChannel < ApplicationCable::Channel
  include Hibiki::Rails::Channel

  Entry = Recipes::Permissions::Entry
  Hall = Recipes::Permissions::Hall
  Member = Recipes::Permissions::Member
  Viewer = Recipes::Permissions::Viewer
  VIEWS = "app/recipes/permissions"

  # A line under the hall's header. `reward` is for a promotion.
  Notice = Data.define(:text, :reward)

  # What a refused action says, by the policy question that refused it.
  REFUSALS = {
    deposit?: "Only members of the guild may deposit. Sign in first.",
    withdraw?: "Only officers and the leader may withdraw.",
    strike?: "You may strike out only your own lines, and an officer any line.",
    promote?: "Only the leader changes other members' ranks.",
    petition?: "The shared account's rank is fixed."
  }.freeze

  rescue_from Pundit::NotAuthorizedError do |error|
    @notice.value = Notice.new(text: REFUSALS.fetch(error.query.to_sym, "That is not yours to do."), reward: false)
  end

  def build_graph
    @version = Hibiki::State.new(0)
    @notice = Hibiki::State.new(nil)
    @withdrawing = Hibiki::State.new(false)
    @everything = Hibiki::State.new(false)

    # The rank is read again on every ping, so a promotion reaches this tab.
    # A Viewer is a plain value: an unchanged rank changes nothing below.
    @viewer = Hibiki::Derived.new do
      @version.value
      Viewer.for(demo_session&.account)
    end
    hall = Hibiki::Derived.new { Hall.new(viewer: @viewer.value) }

    coffer = section(hall, &:coffer)
    ledger = section(hall, &:ledger)
    roster = section(hall, &:roster)

    rank_watch
    paint(:you) { { viewer: @viewer.value, notice: @notice.value } }
    paint(:coffer) { { coffer: coffer.value, withdrawing: @withdrawing.value, everything: @everything.value } }
    paint(:ledger) { { viewer: @viewer.value, lines: ledger.value, everything: @everything.value } }
    paint(:roster) { { viewer: @viewer.value, members: roster.value, everything: @everything.value } }
  end

  def deposit(data)
    authorize Entry, :deposit?
    amount = data["amount"].to_i
    Entry.record(viewer, kind: "deposit", amount:) if Entry::DEPOSITS.include?(amount)
  end

  def open_withdrawal
    authorize Entry, :withdraw?
    @withdrawing.value = true
  end

  def close_withdrawal = @withdrawing.value = false

  def withdraw(data)
    authorize Entry, :withdraw?
    Entry.record(viewer, kind: "withdrawal", amount: data["amount"].to_i, reason: data["reason"].to_s)
    @withdrawing.value = false
    @notice.value = nil
  rescue ActiveRecord::RecordInvalid => error
    @notice.value = Notice.new(text: error.record.errors.map(&:message).first, reward: false)
  end

  def strike(data)
    line = Entry.find_by(id: data["id"])&.row or return
    authorize line, :strike?
    Entry.where(id: line.id, struck_by: nil).update_all(struck_by: viewer.name)
    Member.announce
  end

  def set_rank(data)
    member = Member.find_by(id: data["id"]) or return
    authorize member.row, :promote?
    member.update!(rank: data["rank"]) if Member::RANKS.include?(data["rank"])
  end

  def petition(data)
    authorize own_row, :petition?
    Member.find(own_row.id).update!(rank: data["rank"]) if Member::RANKS.include?(data["rank"])
  end

  # Demo only: also show the buttons this rank may not use, to watch the
  # server refuse them.
  def show_everything(data) = @everything.value = data["everything"] == true

  private

  def subscribed
    super
    return if subscription_rejected?

    Member.join(demo_session.account) if demo_session

    # A rank or a ledger line changed, by anyone. The block runs on a cable
    # thread, so it hops onto the graph thread before touching a signal.
    stream_from Member::CHANGED do
      graph_actor&.post { hear }
    end
  end

  def hear = @version.value += 1

  # The viewer as the database has it now, not as it was when the last
  # render ran: an action asks the policy with this one.
  def viewer = Viewer.for(demo_session&.account)

  def authorize(record, query) = Pundit.authorize(viewer, record, query)

  def own_row = Hall.new(viewer:).own || Member.join(demo_session.account).row

  # One derived per section, each reading the version first, so a ping asks
  # every section again and only a changed answer reaches its effect.
  def section(hall, &question)
    Hibiki::Derived.new do
      @version.value
      question.call(hall.value)
    end
  end

  def paint(name, &locals)
    Hibiki::Effect.new do
      broadcast_morph target: "guild_#{name}", partial: "#{VIEWS}/#{name}", locals: locals.call
    end
  end

  # When the rank changes, say so, and put away a withdrawal this rank may
  # no longer make. `peek` reads without subscribing, since this writes it.
  def rank_watch
    seen = nil
    Hibiki::Effect.new do
      viewer = @viewer.value
      if seen && seen != viewer.rank
        up = Viewer::LEVELS.index(viewer.rank) > Viewer::LEVELS.index(seen)
        @notice.value = Notice.new(text: "You are now #{viewer.rank == "officer" ? "an" : "a"} #{viewer.title.downcase}.", reward: up)
        if @withdrawing.peek && !Pundit.policy!(viewer, Entry).withdraw?
          @withdrawing.value = false
          @notice.value = Notice.new(text: "You are now a #{viewer.title.downcase}, so the withdrawal was put away.", reward: false)
        end
      end
      seen = viewer.rank
    end
  end
end

# frozen_string_literal: true

# Who may do what with the coffer. Asked about the Entry class (deposit,
# withdraw) or about one line (strike).
class Recipes::Permissions::EntryPolicy < Recipes::Permissions::Policy
  def deposit? = at_least?(:recruit)

  def withdraw? = at_least?(:officer)

  # An officer strikes out any line; anyone else, only their own.
  def strike?
    return false if record.struck?

    at_least?(:officer) || (at_least?(:recruit) && record.account_id == viewer.account_id)
  end

  # Which lines of the ledger a viewer may read.
  class Scope
    def initialize(viewer, scope)
      @viewer = viewer
      @scope = scope
    end

    def resolve
      if @viewer.at_least?(:member) then @scope.all
      elsif @viewer.at_least?(:recruit) then @scope.where(account_id: @viewer.account_id)
      else @scope.none
      end
    end
  end
end

# frozen_string_literal: true

# Who may change a rank. Asked about one line of the roster.
class Recipes::Permissions::MemberPolicy < Recipes::Permissions::Policy
  # The leader sets anyone else's rank, except the shared account's.
  def promote? = at_least?(:leader) && record.account_id != viewer.account_id && !record.shared

  # Your own rank, by petition. It is a demo: the leader always says yes.
  # The shared account is everyone's, so its rank is fixed.
  def petition? = !viewer.guest? && !viewer.shared && record.account_id == viewer.account_id
end

# frozen_string_literal: true

# What the guild's policies share. Pundit asks a policy a question such as
# `withdraw?` and expects true or false; `viewer` is the user Pundit was
# handed (Recipes::Permissions::Viewer) and `record` what is asked about.
class Recipes::Permissions::Policy
  attr_reader :viewer, :record

  def initialize(viewer, record)
    @viewer = viewer
    @record = record
  end

  private

  def at_least?(rank) = viewer.at_least?(rank)
end

# frozen_string_literal: true

# The guild hall as one viewer sees it. Each method asks the database and
# the policies, and answers with plain values: the page renders from it,
# and the channel holds one in a derived and asks each section again when
# anything in the hall changes. Every answer about permission comes from a
# Pundit policy, here and in the channel's actions alike.
class Recipes::Permissions::Hall < Data.define(:viewer)
  Entry = Recipes::Permissions::Entry
  Member = Recipes::Permissions::Member

  # What the coffer section offers this viewer.
  Coffer = Data.define(:total, :deposit, :withdraw)

  # How many lines of the ledger are shown.
  LINES = 10

  def coffer
    policy = Pundit.policy!(viewer, Entry)
    Coffer.new(total: Entry.total, deposit: policy.deposit?, withdraw: policy.withdraw?)
  end

  # The newest lines this viewer may read, each with whether they may
  # strike it out.
  def ledger
    Pundit.policy_scope!(viewer, Entry).order(id: :desc).limit(LINES).map(&:row)
          .map { [ it, Pundit.policy!(viewer, it).strike? ] }
  end

  # Every member, each with whether this viewer may change their rank.
  def roster = Member.roster.map { [ it, Pundit.policy!(viewer, it).promote? ] }

  # The viewer's own line of the roster, for the petition, or nil.
  def own = Member.roster.find { it.account_id == viewer.account_id }
end

# frozen_string_literal: true

# Who is looking at the guild hall, as the policies see them: an account
# and its rank, or a guest. It is the `user` Pundit passes to every policy.
# A plain value, read fresh from the database, so a derived holding one
# changes only when the rank does.
class Recipes::Permissions::Viewer < Data.define(:account_id, :name, :rank, :shared)
  # Lowest first. A guest has no account.
  LEVELS = %w[guest recruit member officer leader].freeze

  def self.guest = new(account_id: nil, name: nil, rank: "guest", shared: false)

  def self.for(account)
    return guest unless account

    new(account_id: account.id, name: account.username, rank: Recipes::Permissions::Member.rank_of(account), shared: account.shared?)
  end

  def guest? = account_id.nil?

  def at_least?(rank) = LEVELS.index(self.rank) >= LEVELS.index(rank.to_s)

  def title = rank.capitalize
end

# frozen_string_literal: true

# A demo account's rank in the guild hall. A row is made the first time an
# account opens the hall, as a recruit; the seeded accounts have ranks from
# db/seeds/guild.yml. Recipes::Reset puts those back each night, and the
# rows of other accounts go with them.
class Recipes::Permissions::Member < ApplicationRecord
  self.table_name = "recipes_permissions_members"

  # A line of the roster: a plain copy. `policy_class` tells Pundit which
  # policy judges it, since it is not the model.
  Row = Data.define(:id, :account_id, :name, :rank, :shared) do
    def self.policy_class = Recipes::Permissions::MemberPolicy
  end

  RANKS = %w[recruit member officer leader].freeze

  SEED_FILE = Rails.root.join("db/seeds/guild.yml")

  # Every open hall listens here, for a rank or a ledger entry, from anyone.
  CHANGED = "recipes:permissions:hall"

  belongs_to :account, class_name: "Recipes::Auth::Account"

  after_commit { self.class.announce }

  validates :rank, inclusion: { in: RANKS }

  def self.seeds = YAML.load_file(SEED_FILE)

  # A ping with nothing in it. Whoever hears it reads the hall again.
  def self.announce = ActionCable.server.broadcast(CHANGED, {})

  # The rank, without making a row: an account not seen yet is a recruit.
  def self.rank_of(account) = account.shared? ? "member" : where(account:).pick(:rank) || "recruit"

  # Makes the row the first time an account opens the hall.
  def self.join(account) = find_by(account:) || create!(account:, rank: rank_of(account))

  def self.roster
    includes(:account).sort_by { [ -RANKS.index(it.rank), it.account.username ] }.map(&:row)
  end

  # Gives the seeded accounts their ranks. Safe to run again.
  def self.seed!
    accounts = Recipes::Auth::Account.where(username: seeds.fetch("members").keys).index_by(&:username)
    rows = seeds.fetch("members").filter_map { |name, rank| { account_id: accounts[name].id, rank: } if accounts[name] }
    upsert_all(rows, unique_by: :account_id) if rows.any?
  end

  # `delete_all` and `upsert_all` run no callback, so the ping is sent by
  # hand.
  def self.reset!
    transaction do
      delete_all
      seed!
    end
    announce
  end

  def row = Row.new(id:, account_id:, name: account.username, rank:, shared: account.shared?)
end

# frozen_string_literal: true

# A line in the guild coffer's ledger: a deposit or a withdrawal, which an
# officer may strike out. Nothing in it is typed: amounts come from buttons
# and a number field, and reasons from a list. Recipes::Reset puts the
# starting ledger back each night, and `record` caps it in between.
class Recipes::Permissions::Entry < ApplicationRecord
  self.table_name = "recipes_permissions_entries"

  # A line of the ledger: a plain copy. `policy_class` tells Pundit which
  # policy judges it, since it is not the model.
  Row = Data.define(:id, :account_id, :name, :kind, :amount, :reason, :struck_by) do
    def self.policy_class = Recipes::Permissions::EntryPolicy

    def struck? = !struck_by.nil?
  end

  KINDS = %w[deposit withdrawal].freeze
  DEPOSITS = [ 10, 50, 100 ].freeze
  REASONS = [ "New anvil", "Feast in the hall", "Repairs to the roof", "A bounty paid" ].freeze

  # How many entries the ledger keeps.
  KEEP = 200

  belongs_to :account, class_name: "Recipes::Auth::Account", optional: true

  after_commit { Recipes::Permissions::Member.announce }

  validates :kind, inclusion: { in: KINDS }
  validates :amount, numericality: { only_integer: true, greater_than: 0, message: "A withdrawal is at least 1 gp." }
  validates :reason, inclusion: { in: REASONS, message: "Pick a reason from the list." }, if: -> { kind == "withdrawal" }
  validate :within_the_coffer, if: -> { kind == "withdrawal" && new_record? }

  # What the coffer holds: the deposits less the withdrawals, struck lines
  # left out.
  def self.total
    where(struck_by: nil).group(:kind).sum(:amount).then { it.fetch("deposit", 0) - it.fetch("withdrawal", 0) }
  end

  # Writes a line, and drops the oldest past KEEP in the same transaction,
  # so there is one ping.
  def self.record(viewer, **attrs)
    transaction do
      create!(account_id: viewer.account_id, name: viewer.name, **attrs).tap { prune! }
    end
  end

  def self.prune! = where.not(id: order(id: :desc).limit(KEEP).select(:id)).delete_all

  def self.seeds = Recipes::Permissions::Member.seeds.fetch("entries")

  # Fills an empty ledger with the starting lines. Safe to run again.
  def self.seed!
    return if exists?

    accounts = Recipes::Auth::Account.pluck(:username, :id).to_h
    insert_all(seeds.map { |name, kind, amount, reason| { account_id: accounts[name], name:, kind:, amount:, reason: } })
  end

  def self.reset!
    transaction do
      delete_all
      seed!
    end
    Recipes::Permissions::Member.announce
  end

  def row = Row.new(id:, account_id:, name:, kind:, amount:, reason:, struck_by:)

  private

  def within_the_coffer
    left = self.class.total
    errors.add(:amount, "The coffer holds only #{left.to_fs(:delimited)} gp.") if amount.to_i > left
  end
end

<%# The page builds the hall the channel does, from the same viewer, so the
    first paint and every later one ask the same policies. %>
<% viewer = Recipes::Permissions::Viewer.for(demo_session&.account) %>
<% hall = Recipes::Permissions::Hall.new(viewer:) %>
<%= island Recipes::Permissions::GuildChannel, class: "panel mx-auto w-full max-w-2xl p-4 sm:p-5" do %>
  <header class="flex items-baseline justify-between gap-2">
    <h2 class="text-xl font-bold">The guild hall</h2>
    <span class="loading loading-spinner loading-xs hidden in-data-hibiki-busy:inline-block" aria-hidden="true"></span>
  </header>

  <%= render "app/recipes/permissions/you", viewer:, notice: nil %>

  <label class="mt-2 flex items-center gap-2 text-sm">
    <%= tag.input type: "checkbox", name: "everything", class: "checkbox checkbox-sm", **on(:show_everything, event: :change) %>
    <span>Also show the buttons my rank may not use <span class="badge badge-warning badge-sm">demo only</span></span>
  </label>

  <div class="mt-3 grid gap-4 md:grid-cols-[3fr_2fr]">
    <div class="flex flex-col gap-4">
      <%= render "app/recipes/permissions/coffer", coffer: hall.coffer, withdrawing: false, everything: false %>
      <%= render "app/recipes/permissions/ledger", viewer:, lines: hall.ledger, everything: false %>
    </div>
    <%= render "app/recipes/permissions/roster", viewer:, members: hall.roster, everything: false %>
  </div>
<% end %>

<%# locals: (viewer:, notice:) -%>
<%# Morphed by the channel when the rank changes, or there is something to
    say. A promotion is said in rainbow letters. %>
<div id="guild_you" class="mt-2 flex flex-col gap-2">
  <% if viewer.guest? %>
    <p>You are a guest. <%= link_to "Sign in", app_recipe_path("signin"), class: "link" %> to join the guild.</p>
  <% else %>
    <div class="flex flex-wrap items-center gap-x-3 gap-y-2">
      <p>You are <b><%= viewer.name %></b>, <span id="guild_rank" class="badge badge-primary"><%= viewer.title %></span></p>
      <% if viewer.shared %>
        <p class="text-sm opacity-70">Everyone shares this account, so its rank stays as it is.</p>
      <% else %>
        <%= tag.form id: "guild_petition", class: "flex items-center gap-2", **on(:petition, event: :submit) do %>
          <%= tag.select name: "rank", class: "select select-sm w-auto py-0", "aria-label": "Rank to ask for" do %>
            <%= options_for_select Recipes::Permissions::Member::RANKS.map { [ it.capitalize, it ] }, viewer.rank %>
          <% end %>
          <%= tag.button "Petition the leader", type: "submit", class: "btn btn-sm" %>
        <% end %>
      <% end %>
    </div>
  <% end %>

  <p id="guild_notice" class="min-h-6 text-sm" role="status">
    <% if notice&.reward %>
      <%= rainbow_text notice.text, class: "font-semibold" %>
    <% elsif notice %>
      <%= notice.text %>
    <% end %>
  </p>
</div>

<%# locals: (coffer:, withdrawing:, everything:) -%>
<%# Morphed by the channel. Each button is drawn when the policy allows it,
    or, with the demo box ticked, dashed, to see the server refuse it. %>
<% allowed = ->(ok) { ok ? "btn-primary" : "btn-dash btn-error" } %>
<section id="guild_coffer" class="flex flex-col gap-2">
  <h3 class="font-semibold">The coffer</h3>
  <p class="text-2xl font-bold tabular-nums"><%= coffer.total.to_fs(:delimited) %> gp</p>

  <div class="flex flex-wrap gap-2">
    <% if coffer.deposit || everything %>
      <% Recipes::Permissions::Entry::DEPOSITS.each do |amount| %>
        <%= tag.button "Deposit #{amount} gp", type: "button", id: "guild_deposit_#{amount}",
              class: [ "btn btn-sm", allowed.(coffer.deposit) ], **on(:deposit, with: { amount: }) %>
      <% end %>
    <% end %>
    <% if (coffer.withdraw || everything) && !withdrawing %>
      <%= tag.button "Withdraw…", type: "button", id: "guild_open_withdrawal",
            class: [ "btn btn-sm", allowed.(coffer.withdraw) ], **on(:open_withdrawal) %>
    <% end %>
  </div>

  <% if withdrawing %>
    <%= tag.form id: "guild_withdrawal", class: "flex flex-wrap items-end gap-2 rounded-box bg-base-200 p-3",
          **on(:withdraw, event: :submit, reset: false) do %>
      <label class="flex flex-col gap-1">
        <span class="text-sm font-semibold">Amount</span>
        <%= tag.input type: "number", name: "amount", min: 1, value: 10, class: "input input-sm w-28 tabular-nums" %>
      </label>
      <label class="flex flex-col gap-1">
        <span class="text-sm font-semibold">For</span>
        <%= tag.select name: "reason", class: "select select-sm w-auto py-0" do %>
          <%= options_for_select Recipes::Permissions::Entry::REASONS %>
        <% end %>
      </label>
      <%= tag.button "Withdraw", type: "submit", class: "btn btn-sm btn-primary" %>
      <%= tag.button "Cancel", type: "button", class: "btn btn-sm", **on(:close_withdrawal) %>
    <% end %>
  <% end %>
</section>

<%# locals: (viewer:, lines:, everything:) -%>
<%# Morphed by the channel. `lines` is what the policy's scope lets this
    viewer read, each with whether they may strike it out. %>
<section id="guild_ledger" class="flex flex-col gap-1">
  <h3 class="font-semibold">The ledger</h3>
  <% if viewer.guest? %>
    <p class="text-sm opacity-70">Only members of the guild read the ledger.</p>
  <% elsif viewer.rank == "recruit" %>
    <p class="text-sm opacity-70">A recruit reads only their own lines.</p>
  <% end %>

  <ul class="flex flex-col divide-y divide-base-300 text-sm">
    <% lines.each do |line, strike| %>
      <li id="guild_line_<%= line.id %>" class="flex items-center justify-between gap-2 py-1.5">
        <span class="<%= "line-through opacity-60" if line.struck? %>">
          <b><%= line.name %></b>
          <%= line.kind == "deposit" ? "put in" : "took out" %>
          <span class="tabular-nums"><%= line.amount.to_fs(:delimited) %> gp</span><%= " for #{line.reason.downcase}" if line.reason %>
        </span>
        <% if line.struck? %>
          <span class="text-xs opacity-70">struck out by <%= line.struck_by %></span>
        <% elsif strike || everything %>
          <%= tag.button "Strike out", type: "button", class: [ "btn btn-xs", ("btn-dash btn-error" unless strike) ],
                **on(:strike, with: { id: line.id }) %>
        <% end %>
      </li>
    <% end %>
  </ul>
</section>

<%# locals: (viewer:, members:, everything:) -%>
<%# Morphed by the channel. The leader may set anyone else's rank. %>
<section id="guild_roster" class="flex flex-col gap-1">
  <h3 class="font-semibold">The roster</h3>
  <ul class="flex flex-col divide-y divide-base-300 text-sm">
    <% members.each do |member, promote| %>
      <li id="guild_member_<%= member.id %>" class="flex flex-wrap items-center justify-between gap-2 py-1.5">
        <span>
          <b><%= member.name %></b><%= " (you)" if member.account_id == viewer.account_id %>
        </span>
        <% if promote || (everything && member.account_id != viewer.account_id) %>
          <%= tag.select name: "rank", "aria-label": "Rank of #{member.name}",
                class: [ "select select-xs w-auto py-0", ("select-error border-dashed" unless promote) ],
                **on(:set_rank, event: :change, with: { id: member.id }) do %>
            <%= options_for_select Recipes::Permissions::Member::RANKS.map { [ it.capitalize, it ] }, member.rank %>
          <% end %>
        <% else %>
          <span class="badge badge-sm <%= "badge-primary" if member.rank == "leader" %>"><%= member.rank.capitalize %></span>
        <% end %>
      </li>
    <% end %>
  </ul>
</section>