//! Windows permission backend.
//!
//! Windows has per-resource consent for a subset of the domains we care
//! about (Camera, Microphone, Location, Contacts, Calendar, Email) exposed
//! via the `Windows.Security.Authorization.AppCapabilityAccess` API and
//! Settings → Privacy & Security. Most other domains (Accessibility,
//! Screen Capture, Automation) are not gated at the OS level on desktop
//! Win32 apps — they're either always-available or require UAC for
//! elevation.
//!
//! v1 uses the Windows AppCapability API when running as a packaged app
//! (MSIX/Store); for classic Win32 processes, we return `NotApplicable` for
//! domains that have no meaningful OS-level gate, and do filesystem /
//! binary probes for Browser + Screen Capture.

use super::{Context, Domain, PermissionError, PermissionStatus};

pub fn status_with(domain: Domain, _ctx: &Context) -> Result<PermissionStatus, PermissionError> {
    Ok(match domain {
        Domain::Browser => browser_status(),
        Domain::Camera | Domain::Microphone | Domain::Contacts | Domain::Calendar => {
            // Available through AppCapability for packaged apps. For
            // classic Win32 we conservatively return NotDetermined so the
            // caller knows a runtime attempt is the ground truth.
            PermissionStatus::NotDetermined
        }
        Domain::ScreenCapture => PermissionStatus::Granted,
        Domain::Mail | Domain::Accessibility | Domain::Automation | Domain::HealthRead => {
            PermissionStatus::NotApplicable
        }
        _ => PermissionStatus::NotApplicable,
    })
}

pub fn request_with(domain: Domain, ctx: &Context) -> Result<PermissionStatus, PermissionError> {
    // Windows prompts are tied to specific APIs (e.g. MediaCapture
    // InitializeAsync for camera). Surfacing those requires async + a COM
    // apartment, which we avoid in v1. Return current status.
    status_with(domain, ctx)
}

pub fn describe(domain: Domain, status: PermissionStatus) -> (String, Option<String>) {
    match (domain, status) {
        (_, PermissionStatus::Granted) => ("Granted.".to_string(), None),
        (_, PermissionStatus::NotApplicable) => (
            "Not applicable on Windows for this domain.".to_string(),
            None,
        ),
        (Domain::Browser, _) => (
            "No Chrome/Chromium/Edge binary found in standard locations.".to_string(),
            Some(
                "Install Google Chrome or Microsoft Edge (Edge ships with \
                 Windows 10/11)."
                    .to_string(),
            ),
        ),
        (Domain::Camera, _) => (
            "Camera access is controlled by Windows privacy settings.".to_string(),
            Some(
                "Settings → Privacy & security → Camera → enable for \
                 desktop apps."
                    .to_string(),
            ),
        ),
        (Domain::Microphone, _) => (
            "Microphone access is controlled by Windows privacy settings.".to_string(),
            Some(
                "Settings → Privacy & security → Microphone → enable for \
                 desktop apps."
                    .to_string(),
            ),
        ),
        (Domain::Contacts, _) => (
            "Contacts access is controlled by Windows privacy settings.".to_string(),
            Some(
                "Settings → Privacy & security → Contacts → enable for \
                 desktop apps."
                    .to_string(),
            ),
        ),
        (Domain::Calendar, _) => (
            "Calendar access is controlled by Windows privacy settings.".to_string(),
            Some(
                "Settings → Privacy & security → Calendar → enable for \
                 desktop apps."
                    .to_string(),
            ),
        ),
        (
            Domain::ScreenCapture
            | Domain::Mail
            | Domain::Accessibility
            | Domain::Automation
            | Domain::HealthRead,
            _,
        ) => ("Not modeled on Windows yet.".to_string(), None),
        (_, _) => ("Domain not modeled on Windows yet.".to_string(), None),
    }
}

fn browser_status() -> PermissionStatus {
    let candidates = [
        r"C:\Program Files\Google\Chrome\Application\chrome.exe",
        r"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe",
        r"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe",
        r"C:\Program Files\Microsoft\Edge\Application\msedge.exe",
    ];
    for c in candidates {
        if std::path::Path::new(c).exists() {
            return PermissionStatus::Granted;
        }
    }
    PermissionStatus::Denied
}
