package com.zioinfo.hrm.common;

import org.springframework.security.core.Authentication;

import java.util.Set;

/**
 * 컨트롤러 공통 — Authentication 에서 actor(username)/role 추출 + HR_MANAGER+ 가드.
 */
public final class AuthSupport {

    private static final Set<String> MANAGER_ROLES = Set.of("MANAGER", "SUPERADMIN");

    private AuthSupport() {}

    public static String actor(Authentication a) {
        return a != null ? a.getName() : "system";
    }

    public static String role(Authentication a) {
        if (a == null || a.getAuthorities().isEmpty()) return "VIEWER";
        String r = a.getAuthorities().iterator().next().getAuthority();
        return r.startsWith("ROLE_") ? r.substring(5) : r;
    }

    public static void requireManager(Authentication a) {
        if (!MANAGER_ROLES.contains(role(a).toUpperCase())) {
            throw new RuntimeException("ERR-HRM-403: 급여처리/승인은 MANAGER 이상만 가능합니다");
        }
    }
}
