const urlJoin = require('url-join');
const { PodCollectionsHandlerMixin } = require('@activitypods/app');
const CONFIG = require('../config/config');

// Visibility decision: the attendees collection is readable by ANY visitor, including
// unauthenticated ones (acl:agentClass foaf:Agent). A meeting point's participant count and
// its list of participants must be visible to non-contacts — the app shows outsiders the
// anonymous participants plus the total counter, and that is a product feature, not a leak.
// Member URIs are not secret; the anonymity guarantee lives in each profile's own WAC (a
// participant whose profile is not shared simply renders as anonymous), not here. The
// reference welcometomyplace grants this to its announces group, but Festipod has no
// announces concept, so the grant is public.
module.exports = {
  name: 'attendees',
  mixins: [PodCollectionsHandlerMixin],
  settings: {
    shapeTreeUri: urlJoin(CONFIG.SHAPE_REPOSITORY_URL, 'shapetrees/as/Event'),
    attachPredicate: 'http://activitypods.org/ns/core#attendees',
    collectionOptions: {
      ordered: false,
      summary: 'Meeting point attendees'
    },
    createWacGroup: true
  },
  actions: {
    async givePublicReadPermission(ctx) {
      const { collectionUri, actorUri } = ctx.params;

      await ctx.call('pod-permissions.add', {
        uri: collectionUri,
        agentPredicate: 'acl:agentClass',
        agentUri: 'http://xmlns.com/foaf/0.1/Agent',
        mode: 'acl:Read',
        actorUri
      });
    }
  },
  hooks: {
    after: {
      async createAndAttach(ctx, res) {
        const { actorUri } = ctx.params;
        const collectionUri = res;

        await this.actions.givePublicReadPermission({ collectionUri, actorUri }, { parentCtx: ctx });

        return res;
      }
    }
  }
};