from __future__ import annotations

import uuid

from sqlalchemy import ColumnElement, exists, or_, select

from .models.group import GroupMember
from .models.share import Share


def visible_to_user(
    resource_type: str,
    owner_column,
    resource_id_column,
    user_id: uuid.UUID,
) -> ColumnElement[bool]:
    """Boolean SQL predicate: is this resource visible to ``user_id``?

    A resource is visible if the user OWNS it, OR it is shared DIRECTLY with the
    user, OR it is shared with a GROUP the user belongs to. Scope every read (and
    mutation) of shareable user data through this — never assume a single operator
    (family rule 47).

    Usage (M1+), e.g. for notes::

        stmt = select(Note).where(visible_to_user("note", Note.owner_id, Note.id, uid))

    Args:
        resource_type: the ``Share.resource_type`` tag for this entity (e.g. "note").
        owner_column: the resource's owner column (e.g. ``Note.owner_id``).
        resource_id_column: the resource's primary-key column (e.g. ``Note.id``).
        user_id: the viewer.
    """
    user_group_ids = select(GroupMember.group_id).where(GroupMember.user_id == user_id)

    direct_share = exists().where(
        Share.resource_type == resource_type,
        Share.resource_id == resource_id_column,
        Share.shared_with_user_id == user_id,
    )
    group_share = exists().where(
        Share.resource_type == resource_type,
        Share.resource_id == resource_id_column,
        Share.shared_with_group_id.in_(user_group_ids),
    )
    return or_(owner_column == user_id, direct_share, group_share)