<?php

namespace App\Security;

use App\Entity\Company;
use App\Entity\Employee;
use App\Entity\Reseller;
use Symfony\Bundle\SecurityBundle\Security;

/**
 * Liefert den Mandantenkontext (Reseller/Company) des eingeloggten Mitarbeiters.
 * Alles wird aus dem Employee abgeleitet (Employee = Login-Identität):
 *  - Reseller = company.reseller
 *  - Company  = die eigene Firma NUR für Firmen-Admins/Mitarbeiter; Reseller-/
 *    Plattform-Admins arbeiten reseller-weit (company = null).
 * Plattform-Admins sehen alles.
 */
final class TenantContext
{
    public function __construct(private readonly Security $security)
    {
    }

    public function getEmployee(): ?Employee
    {
        $user = $this->security->getUser();

        return $user instanceof Employee ? $user : null;
    }

    public function isPlatformAdmin(): bool
    {
        return $this->security->isGranted(Employee::ROLE_PLATFORM_ADMIN);
    }

    public function getReseller(): ?Reseller
    {
        return $this->getEmployee()?->getCompany()->getReseller();
    }

    public function getCompany(): ?Company
    {
        // Reseller-/Plattform-Admins sind reseller-weit unterwegs → keine Company-Einschränkung
        if ($this->security->isGranted(Employee::ROLE_RESELLER_ADMIN)) {
            return null;
        }

        return $this->getEmployee()?->getCompany();
    }
}