package compliance

import (
	"context"
	"fmt"

	"github.com/niels/banking-app/backend/internal/aml"
	"github.com/niels/banking-app/backend/internal/domain"
	"github.com/niels/banking-app/backend/internal/kyc"
)

type Guard struct {
	kyc *kyc.Repository
	aml *aml.Repository
}

func NewGuard(kycRepo *kyc.Repository, amlRepo *aml.Repository) *Guard {
	return &Guard{kyc: kycRepo, aml: amlRepo}
}

func (g *Guard) RequireClear(ctx context.Context, userID string) error {
	verified, err := g.kyc.IsUserVerified(ctx, userID)
	if err != nil {
		return err
	}
	if !verified {
		return fmt.Errorf("%w: KYC verification required", domain.ErrForbidden)
	}

	openCase, err := g.aml.HasOpenCase(ctx, userID)
	if err != nil {
		return err
	}
	if openCase {
		return fmt.Errorf("%w: AML review required", domain.ErrForbidden)
	}

	return nil
}