package saas

import (
	"context"
	"data-terminal-cloud/internal/callmemory"
	"data-terminal-cloud/internal/identity"
	"github.com/jackc/pgx/v5"
)

func (s *Service) checkMemoryGrant(ctx context.Context, q interface {
	QueryRow(context.Context, string, ...any) pgx.Row
}, p identity.Principal, id string, write bool) error {
	var elder, sensitivity string
	if e := q.QueryRow(ctx, `SELECT sp.public_id::text,cm.sensitivity FROM curated_memory cm JOIN subject_profile sp ON sp.id=cm.subject_id WHERE cm.public_id=$1::uuid`, id).Scan(&elder, &sensitivity); e != nil {
		return ErrAccessDenied
	}
	a, e := callmemory.ResolveAccess(ctx, q, p, elder, write)
	if e != nil || (!a.Sensitive && sensitivity != "normal") {
		return ErrAccessDenied
	}
	return nil
}