import { GenericActionCtx } from 'convex/server';

import { internal } from '../_generated/api';
import { DataModel } from '../_generated/dataModel';
import { isAdmin } from '../lib/rls/helpers/role_helpers';

type RemoveSsoProviderArgs = {
  organizationId: string;
};

export async function removeSsoProvider(
  ctx: GenericActionCtx<DataModel>,
  args: RemoveSsoProviderArgs,
): Promise<null> {
  const authUser = await ctx.runQuery(
    internal.sso_providers.internal_queries.getAuthUser,
    {},
  );
  if (!authUser) {
    throw new Error('Unauthenticated');
  }

  const callerRole = await ctx.runQuery(
    internal.sso_providers.internal_queries.getCallerRole,
    {
      organizationId: args.organizationId,
      userId: authUser._id,
    },
  );

  if (!isAdmin(callerRole)) {
    throw new Error('Only admins can remove SSO providers');
  }

  await ctx.runMutation(
    internal.sso_providers.internal_mutations.removeProvider,
    {
      organizationId: args.organizationId,
      actorId: authUser._id,
      actorEmail: authUser.email,
      actorRole: callerRole ?? 'member',
    },
  );

  return null;
}
