import { loadActiveUserById, toViewer } from "../auth";
import { hasPermission, loadRepoById, repoPermission } from "../repos";
import { containersAllowedFor } from "./container-meter";

/**
 * Whether a running container's owner may still have it: the account exists, its plan still includes
 * containers, and it still has write access to the repo. Checked by the alarm so a downgrade or a revoked
 * collaborator doesn't keep a live shell until the cap.
 */
export async function containerStillAuthorized(accountId: string, repoId: string): Promise<boolean> {
  const [user, repo] = await Promise.all([loadActiveUserById(accountId), loadRepoById(repoId)]);
  if (!user || !repo) return false;
  if (!hasPermission(await repoPermission(repo, toViewer(user)), "write")) return false;
  return containersAllowedFor(accountId);
}