tatlock-ui/lib/core/auth/permission_gate.dart

import 'package:flutter/widgets.dart' hide Action;
import 'package:flutter_riverpod/flutter_riverpod.dart';

import 'auth_provider.dart';
import 'permissions.dart';

/// A widget that conditionally renders its child based on user permissions.
///
/// Example:
/// ```dart
/// PermissionGate(
///   domain: Domain.controlRoom,
///   action: Action.admin,
///   child: DeleteButton(),
///   fallback: Text('No permission'),
/// )
/// ```
class PermissionGate extends ConsumerWidget {
  const PermissionGate({
    super.key,
    required this.domain,
    required this.action,
    this.category = 'general',
    required this.child,
    this.fallback,
  });

  /// The domain required for this permission.
  final Domain domain;

  /// The action level required (viewer, user, editor, admin).
  final Action action;

  /// Optional category within the domain (defaults to 'general').
  final String category;

  /// Widget to show when user has permission.
  final Widget child;

  /// Widget to show when user lacks permission (defaults to empty).
  final Widget? fallback;

  @override
  Widget build(BuildContext context, WidgetRef ref) {
    final authState = ref.watch(authProvider);

    final hasPermission = authState.maybeWhen(
      data: (state) => state.hasPermission(domain, action, category: category),
      orElse: () => false,
    );

    if (hasPermission) {
      return child;
    }

    return fallback ?? const SizedBox.shrink();
  }
}

/// A widget that shows its child only if the user is a global admin.
class AdminGate extends ConsumerWidget {
  const AdminGate({
    super.key,
    required this.child,
    this.fallback,
  });

  /// Widget to show when user is admin.
  final Widget child;

  /// Widget to show when user is not admin (defaults to empty).
  final Widget? fallback;

  @override
  Widget build(BuildContext context, WidgetRef ref) {
    final authState = ref.watch(authProvider);

    final isAdmin = authState.maybeWhen(
      data: (state) => state.isGlobalAdmin,
      orElse: () => false,
    );

    if (isAdmin) {
      return child;
    }

    return fallback ?? const SizedBox.shrink();
  }
}

/// Extension for checking permissions in code.
extension PermissionCheck on WidgetRef {
  /// Check if the current user has a specific permission.
  bool hasPermission(Domain domain, Action action, {String category = 'general'}) {
    final authState = read(authProvider);
    return authState.maybeWhen(
      data: (state) => state.hasPermission(domain, action, category: category),
      orElse: () => false,
    );
  }

  /// Check if the current user is a global admin.
  bool get isGlobalAdmin {
    final authState = read(authProvider);
    return authState.maybeWhen(
      data: (state) => state.isGlobalAdmin,
      orElse: () => false,
    );
  }
}