"""What server-side expressions (app/core/expr.py) know about the person a
request is for — the same `user` the browser builds (frontend/src/lib/
exprContext.ts), so HASROLE('Approver') or user.email decide the same way
on both sides."""

import uuid

from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession

from app.models.identity import Role, User, UserRole


async def user_scope(db: AsyncSession, tenant_id: uuid.UUID, user_id: uuid.UUID | None) -> dict:
    """{"user": {id, name, email, vendor_id, tenant_id, roles: [role names]}}."""
    if user_id is None:
        return {"user": {"roles": []}}
    user = await db.get(User, user_id)
    if user is None or user.tenant_id != tenant_id:
        return {"user": {"roles": []}}
    roles = (
        await db.execute(
            select(Role.name).join(UserRole, UserRole.role_id == Role.id).where(UserRole.user_id == user_id, Role.tenant_id == tenant_id)
        )
    ).scalars().all()
    return {
        "user": {
            "id": str(user.id),
            "name": user.name,
            "email": user.email,
            "vendor_id": str(user.vendor_id) if user.vendor_id else "",
            "tenant_id": str(user.tenant_id),
            "roles": list(roles),
        }
    }