using Fitness_core_BE.DTOs.Rbac;
using Microsoft.AspNetCore.Http;

namespace Fitness_core_BE.Interfaces.Services
{
    // Owner-only role CRUD + staff-role assignment. Every method resolves the caller via
    // UserRoleHelper.GetClientId directly and never consults IPermissionService/GymRolePermission —
    // this is what makes role management immune to staff self-escalation: no nav-section
    // permission can ever unlock these methods for a staff account.
    public interface IGymRoleService
    {
        Task<List<GymRoleDto>> GetRolesAsync(HttpContext httpContext);
        Task<GymRoleDto> CreateRoleAsync(CreateGymRoleRequest request, HttpContext httpContext);
        Task<GymRoleDto> UpdateRoleAsync(Guid gymRoleId, UpdateGymRoleRequest request, HttpContext httpContext);
        Task DeleteRoleAsync(Guid gymRoleId, HttpContext httpContext);
        Task<GymRoleDto> SetRolePermissionsAsync(Guid gymRoleId, SetRolePermissionsRequest request, HttpContext httpContext);
        Task AssignStaffRoleAsync(Guid staffId, AssignStaffRoleRequest request, HttpContext httpContext);
    }
}