@page "/notifications/report"
@attribute [Authorize(Policy = ZB.MOM.WW.ScadaBridge.Security.AuthorizationPolicies.RequireDeployment)]
@using ZB.MOM.WW.ScadaBridge.CentralUI.Auth
@using ZB.MOM.WW.ScadaBridge.Commons.Entities.Sites
@using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories
@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Notification
@using ZB.MOM.WW.ScadaBridge.Communication
@inject CommunicationService CommunicationService
@inject ISiteRepository SiteRepository
@inject SiteScopeService SiteScope
@inject IDialogService Dialog
@inject ILogger<NotificationReport> Logger

<div class="container-fluid mt-3">
    <ToastNotification @ref="_toast" />

    <div class="d-flex justify-content-between align-items-center mb-3">
        <h4 class="mb-0">Notification Report</h4>
        <button class="btn btn-outline-secondary btn-sm" @onclick="RefreshAll" disabled="@_loading">
            @if (_loading) { <span class="spinner-border spinner-border-sm me-1" role="status"></span> }
            Refresh
        </button>
    </div>

    @* ── Filters ── *@
    <div class="card mb-3">
        <div class="card-body py-2">
            <div class="row g-2 align-items-end">
                <div class="col-auto">
                    <label class="form-label small mb-1" for="no-status">Status</label>
                    <select id="no-status" class="form-select form-select-sm" style="min-width: 130px;"
                            @bind="_statusFilter">
                        <option value="">All</option>
                        <option value="Pending">Pending</option>
                        <option value="Retrying">Retrying</option>
                        <option value="Delivered">Delivered</option>
                        <option value="Parked">Parked</option>
                        <option value="Discarded">Discarded</option>
                    </select>
                </div>
                <div class="col-auto">
                    <label class="form-label small mb-1" for="no-type">Type</label>
                    <select id="no-type" class="form-select form-select-sm" style="min-width: 120px;"
                            @bind="_typeFilter">
                        <option value="">All</option>
                        <option value="Email">Email</option>
                    </select>
                </div>
                <div class="col-auto">
                    <label class="form-label small mb-1" for="no-site">Source site</label>
                    <select id="no-site" class="form-select form-select-sm" style="min-width: 150px;"
                            @bind="_siteFilter">
                        <option value="">Any</option>
                        @foreach (var site in _sites)
                        {
                            <option value="@site.SiteIdentifier">@site.Name</option>
                        }
                    </select>
                </div>
                <div class="col-auto">
                    <label class="form-label small mb-1" for="no-list">List name</label>
                    <input id="no-list" type="text" class="form-control form-control-sm"
                           style="min-width: 140px;" placeholder="Any" @bind="_listFilter" />
                </div>
                @* Task 16: free-text Node filter — exact match against the
                   notification's SourceNode column. Sites + central nodes
                   both flow through this single input. *@
                <div class="col-auto">
                    <label class="form-label small mb-1" for="no-node">Node</label>
                    <input id="no-node" type="text" class="form-control form-control-sm"
                           style="min-width: 140px;" placeholder="Any"
                           data-test="notif-filter-node"
                           @bind="_nodeFilter" />
                </div>
                <div class="col-auto">
                    <label class="form-label small mb-1" for="no-from">From</label>
                    <input id="no-from" type="datetime-local" class="form-control form-control-sm"
                           @bind="_fromFilter" />
                </div>
                <div class="col-auto">
                    <label class="form-label small mb-1" for="no-to">To</label>
                    <input id="no-to" type="datetime-local" class="form-control form-control-sm"
                           @bind="_toFilter" />
                </div>
                <div class="col">
                    <label class="form-label small mb-1" for="no-search">Subject keyword</label>
                    <input id="no-search" type="search" class="form-control form-control-sm"
                           placeholder="Search subject…" @bind="_subjectFilter" />
                </div>
                <div class="col-auto">
                    <div class="form-check mb-1">
                        <input class="form-check-input" type="checkbox" id="no-stuck-only"
                               @bind="_stuckOnly" />
                        <label class="form-check-label small" for="no-stuck-only">Stuck only</label>
                    </div>
                </div>
                <div class="col-auto">
                    <button class="btn btn-outline-secondary btn-sm" @onclick="ClearFilters"
                            disabled="@(!HasActiveFilters)">Clear</button>
                </div>
                <div class="col-auto">
                    <button class="btn btn-primary btn-sm" @onclick="Search" disabled="@_loading">
                        @if (_loading) { <span class="spinner-border spinner-border-sm me-1" role="status"></span> }
                        Query
                    </button>
                </div>
            </div>
        </div>
    </div>

    @if (_listError != null)
    {
        <div class="alert alert-danger">@_listError</div>
    }

    @* ── Notification list ── *@
    @if (_notifications == null)
    {
        @if (_loading)
        {
            <div class="text-muted small">Loading…</div>
        }
    }
    else if (_notifications.Count == 0)
    {
        <div class="card">
            <div class="card-body text-center text-muted py-5">
                <div class="fs-5 mb-1">No notifications</div>
                <div class="small">No notifications match the current filters.</div>
            </div>
        </div>
    }
    else
    {
        <div class="table-responsive">
            <table class="table table-sm table-hover align-middle">
                <thead class="table-light">
                    <tr>
                        <th>ID</th>
                        <th>Type</th>
                        <th>List</th>
                        <th>Subject</th>
                        <th>Status</th>
                        <th class="text-end">Retries</th>
                        <th>Source site</th>
                        <th>Node</th>
                        <th>Created</th>
                        <th>Delivered</th>
                        <th class="text-end">Actions</th>
                    </tr>
                </thead>
                <tbody>
                    @foreach (var n in _notifications)
                    {
                        <tr @key="n.NotificationId" class="@(n.IsStuck ? "table-warning" : "")"
                            style="cursor: pointer;" @ondblclick="() => ShowDetail(n)"
                            title="Double-click for full detail">
                            <td><code class="small" title="@n.NotificationId">@ShortId(n.NotificationId)</code></td>
                            <td>@n.Type</td>
                            <td>@n.ListName</td>
                            <td>
                                @n.Subject
                                @if (!string.IsNullOrEmpty(n.LastError))
                                {
                                    <div class="small text-danger text-truncate" style="max-width: 320px;"
                                         title="@n.LastError">@n.LastError</div>
                                }
                            </td>
                            <td>
                                <span class="badge @StatusBadgeClass(n.Status)">@n.Status</span>
                                @if (n.IsStuck)
                                {
                                    <span class="badge bg-warning text-dark ms-1">Stuck</span>
                                }
                            </td>
                            <td class="text-end font-monospace">@n.RetryCount</td>
                            <td><span class="small">@SiteName(n.SourceSiteId)</span></td>
                            <td><span class="small">@(n.SourceNode ?? "—")</span></td>
                            <td><TimestampDisplay Value="@n.CreatedAt" Format="yyyy-MM-dd HH:mm" /></td>
                            <td><TimestampDisplay Value="@n.DeliveredAt" Format="yyyy-MM-dd HH:mm" NullText="—" /></td>
                            <td class="text-end" @ondblclick:stopPropagation="true">
                                @* Bundle D (#23 M7-T10) drill-in: NotificationId is the audit
                                   CorrelationId, so the link deep-links into the central Audit
                                   Log pre-filtered to this notification's lifecycle events. *@
                                <a class="btn btn-outline-secondary btn-sm me-1"
                                   href="/audit/log?correlationId=@n.NotificationId"
                                   data-test="audit-link-@n.NotificationId">
                                    View audit history
                                </a>
                                @if (n.Status == "Parked")
                                {
                                    <button class="btn btn-outline-success btn-sm me-1"
                                            @onclick="() => RetryNotification(n)" disabled="@_actionInProgress">
                                        Retry
                                    </button>
                                    <button class="btn btn-outline-danger btn-sm"
                                            @onclick="() => DiscardNotification(n)" disabled="@_actionInProgress">
                                        Discard
                                    </button>
                                }
                            </td>
                        </tr>
                    }
                </tbody>
            </table>
        </div>

        @if (_totalCount > _pageSize)
        {
            <div class="d-flex justify-content-between align-items-center">
                <span class="text-muted small">
                    Page @_pageNumber of @((_totalCount + _pageSize - 1) / _pageSize) · @_totalCount total
                </span>
                <div>
                    <button class="btn btn-outline-secondary btn-sm me-1"
                            @onclick="PrevPage" disabled="@(_pageNumber <= 1 || _loading)">Previous</button>
                    <button class="btn btn-outline-secondary btn-sm"
                            @onclick="NextPage" disabled="@(_notifications.Count < _pageSize || _loading)">Next</button>
                </div>
            </div>
        }
    }
</div>

@* ── Row detail modal ── *@
@if (_detailNotification != null)
{
    var d = _detailNotification;
    <div class="modal show d-block" tabindex="-1" style="background: rgba(0,0,0,0.4);"
         @onclick="CloseDetail">
        <div class="modal-dialog modal-dialog-scrollable modal-lg" @onclick:stopPropagation="true">
            <div class="modal-content">
                <div class="modal-header">
                    <h6 class="modal-title">Notification Detail — @ShortId(d.NotificationId)</h6>
                    <button type="button" class="btn-close" aria-label="Close"
                            @onclick="CloseDetail"></button>
                </div>
                <div class="modal-body">
                    <dl class="row mb-0">
                        <dt class="col-sm-3">Notification ID</dt>
                        <dd class="col-sm-9"><code>@d.NotificationId</code></dd>

                        <dt class="col-sm-3">Type</dt>
                        <dd class="col-sm-9">@d.Type</dd>

                        <dt class="col-sm-3">List</dt>
                        <dd class="col-sm-9">@d.ListName</dd>

                        <dt class="col-sm-3">Subject</dt>
                        <dd class="col-sm-9">@d.Subject</dd>

                        <dt class="col-sm-3">Status</dt>
                        <dd class="col-sm-9">
                            <span class="badge @StatusBadgeClass(d.Status)">@d.Status</span>
                            @if (d.IsStuck)
                            {
                                <span class="badge bg-warning text-dark ms-1">Stuck</span>
                            }
                        </dd>

                        <dt class="col-sm-3">Stuck</dt>
                        <dd class="col-sm-9">@(d.IsStuck ? "Yes" : "No")</dd>

                        <dt class="col-sm-3">Retry count</dt>
                        <dd class="col-sm-9 font-monospace">@d.RetryCount</dd>

                        <dt class="col-sm-3">Source site</dt>
                        <dd class="col-sm-9">@SiteName(d.SourceSiteId)</dd>

                        <dt class="col-sm-3">Source node</dt>
                        <dd class="col-sm-9">@(string.IsNullOrEmpty(_detail?.SourceNode) ? "—" : _detail.SourceNode)</dd>

                        <dt class="col-sm-3">Source instance</dt>
                        <dd class="col-sm-9">@(string.IsNullOrEmpty(d.SourceInstanceId) ? "—" : d.SourceInstanceId)</dd>

                        <dt class="col-sm-3">Created</dt>
                        <dd class="col-sm-9"><TimestampDisplay Value="@d.CreatedAt" Format="yyyy-MM-dd HH:mm:ss" /></dd>

                        <dt class="col-sm-3">Delivered</dt>
                        <dd class="col-sm-9"><TimestampDisplay Value="@d.DeliveredAt" Format="yyyy-MM-dd HH:mm:ss" NullText="—" /></dd>

                        @if (!string.IsNullOrEmpty(d.LastError))
                        {
                            <dt class="col-sm-3">Last error</dt>
                            <dd class="col-sm-9 text-danger">@d.LastError</dd>
                        }
                    </dl>

                    @* ── Recipients ── *@
                    <hr />
                    <h6 class="mb-2">Recipients</h6>
                    @if (_detailLoading)
                    {
                        <div class="text-muted small">
                            <span class="spinner-border spinner-border-sm me-1" role="status"></span>
                            Loading details…
                        </div>
                    }
                    else if (_detailError != null)
                    {
                        <div class="text-danger small">@_detailError</div>
                    }
                    else if (_detail != null)
                    {
                        var recipients = ParseRecipients(_detail.ResolvedTargets);
                        if (recipients.Count > 0)
                        {
                            <ul class="mb-0">
                                @foreach (var recipient in recipients)
                                {
                                    <li>@recipient</li>
                                }
                            </ul>
                        }
                        else
                        {
                            <div class="text-muted small">
                                Not yet resolved — recipients are resolved from list
                                "@d.ListName" at delivery time.
                            </div>
                        }
                    }

                    @* ── Body ── *@
                    <hr />
                    <h6 class="mb-2">Message body</h6>
                    @if (_detailLoading)
                    {
                        <div class="text-muted small">
                            <span class="spinner-border spinner-border-sm me-1" role="status"></span>
                            Loading details…
                        </div>
                    }
                    else if (_detailError != null)
                    {
                        <div class="text-danger small">@_detailError</div>
                    }
                    else if (_detail != null)
                    {
                        @* Email bodies are plain text (design: BCC delivery, plain text).
                           Rendered as preformatted text — never as a MarkupString, which
                           would be an XSS vector. *@
                        <pre class="border rounded bg-light p-2 mb-0"
                             style="max-height: 320px; overflow: auto; white-space: pre-wrap; word-break: break-word;">@_detail.Body</pre>
                    }
                </div>
                <div class="modal-footer">
                    @if (d.Status == "Parked")
                    {
                        <button class="btn btn-outline-success btn-sm"
                                @onclick="() => RetryFromDetail(d)" disabled="@_actionInProgress">
                            Retry
                        </button>
                        <button class="btn btn-outline-danger btn-sm"
                                @onclick="() => DiscardFromDetail(d)" disabled="@_actionInProgress">
                            Discard
                        </button>
                    }
                    <button class="btn btn-outline-secondary btn-sm" @onclick="CloseDetail">Close</button>
                </div>
            </div>
        </div>
    </div>
}

@code {
    private const int _pageSize = 50;

    private ToastNotification _toast = default!;
    private List<Site> _sites = new();
    // CentralUI-028: full site list (kept unfiltered) so a permitted-site check
    // resolves correctly for a SourceSiteId whose Site was filtered out of the
    // dropdown. Set once in OnInitializedAsync alongside _sites.
    private List<Site> _allSites = new();
    private bool _siteScopeSystemWide;
    private HashSet<int> _permittedSiteIds = new();

    // List
    private List<NotificationSummary>? _notifications;
    private int _totalCount;
    private int _pageNumber = 1;
    private bool _loading;
    private string? _listError;
    private bool _actionInProgress;

    // Row detail modal
    private NotificationSummary? _detailNotification;
    private NotificationDetail? _detail;
    private bool _detailLoading;
    private string? _detailError;

    // Filters
    private string _statusFilter = string.Empty;
    private string _typeFilter = string.Empty;
    private string _siteFilter = string.Empty;
    private string _listFilter = string.Empty;
    private string _subjectFilter = string.Empty;
    private string _nodeFilter = string.Empty;
    private bool _stuckOnly;
    private DateTime? _fromFilter;
    private DateTime? _toFilter;

    protected override async Task OnInitializedAsync()
    {
        try
        {
            _allSites = (await SiteRepository.GetAllSitesAsync()).ToList();
            // CentralUI-028: restrict the site dropdown to the user's permitted set
            // so a site-scoped Deployment user cannot select a site they have no
            // grant for. System-wide users see the full list back unchanged.
            _sites = await SiteScope.FilterSitesAsync(_allSites);
            _siteScopeSystemWide = await SiteScope.IsSystemWideAsync();
            _permittedSiteIds = new HashSet<int>(await SiteScope.PermittedSiteIdsAsync());
        }
        catch (Exception ex)
        {
            // Non-fatal — source-site filter just falls back to the raw site IDs.
            Logger.LogWarning(ex, "Failed to load sites for the report source-site filter.");
        }

        await RefreshAll();
    }

    private async Task RefreshAll()
    {
        await FetchPage();
    }

    private async Task Search()
    {
        _pageNumber = 1;
        await FetchPage();
    }

    private async Task PrevPage() { _pageNumber--; await FetchPage(); }
    private async Task NextPage() { _pageNumber++; await FetchPage(); }

    private async Task FetchPage()
    {
        _loading = true;
        _listError = null;
        try
        {
            var request = new NotificationOutboxQueryRequest(
                CorrelationId: Guid.NewGuid().ToString("N"),
                StatusFilter: NullIfEmpty(_statusFilter),
                TypeFilter: NullIfEmpty(_typeFilter),
                SourceSiteFilter: NullIfEmpty(_siteFilter),
                ListNameFilter: NullIfEmpty(_listFilter),
                StuckOnly: _stuckOnly,
                SubjectKeyword: NullIfEmpty(_subjectFilter),
                From: ToUtc(_fromFilter),
                To: ToUtc(_toFilter),
                PageNumber: _pageNumber,
                PageSize: _pageSize,
                SourceNodeFilter: NullIfEmpty(_nodeFilter));

            var response = await CommunicationService.QueryNotificationOutboxAsync(request);
            if (response.Success)
            {
                // CentralUI-028: drop any row whose source site is outside the
                // user's permitted set. The query API accepts only a single
                // SourceSiteFilter, so a scoped user with an empty filter could
                // otherwise see every site's rows; this is the row-level safety
                // net behind the dropdown restriction.
                _notifications = await FilterPermittedAsync(response.Notifications);
                _totalCount = response.TotalCount;
            }
            else
            {
                _listError = response.ErrorMessage ?? "Query failed.";
            }
        }
        catch (Exception ex)
        {
            _listError = $"Query failed: {ex.Message}";
        }
        _loading = false;
    }

    private async Task RetryNotification(NotificationSummary n)
    {
        // CentralUI-028: server-side re-check before relaying — even if the row
        // somehow made it into the grid for an out-of-scope user (race with a
        // permission change, stale circuit cache), the relay must not fire.
        if (!await IsRowSiteAllowedAsync(n.SourceSiteId))
        {
            _toast.ShowError("You are not permitted to act on notifications for this site.");
            return;
        }

        var confirmed = await Dialog.ConfirmAsync(
            "Retry notification",
            $"Re-queue notification {ShortId(n.NotificationId)} (\"{n.Subject}\") for delivery?");
        if (!confirmed) return;

        _actionInProgress = true;
        try
        {
            var response = await CommunicationService.RetryNotificationAsync(
                new RetryNotificationRequest(Guid.NewGuid().ToString("N"), n.NotificationId));
            if (response.Success)
            {
                _toast.ShowSuccess($"Notification {ShortId(n.NotificationId)} re-queued for delivery.");
                await RefreshAll();
            }
            else
            {
                _toast.ShowError(response.ErrorMessage ?? "Retry failed.");
            }
        }
        catch (Exception ex)
        {
            _toast.ShowError($"Retry failed: {ex.Message}");
        }
        _actionInProgress = false;
    }

    private async Task DiscardNotification(NotificationSummary n)
    {
        if (!await IsRowSiteAllowedAsync(n.SourceSiteId))
        {
            _toast.ShowError("You are not permitted to act on notifications for this site.");
            return;
        }

        var confirmed = await Dialog.ConfirmAsync(
            "Discard notification",
            $"Permanently discard notification {ShortId(n.NotificationId)} (\"{n.Subject}\")? This cannot be undone.",
            danger: true);
        if (!confirmed) return;

        _actionInProgress = true;
        try
        {
            var response = await CommunicationService.DiscardNotificationAsync(
                new DiscardNotificationRequest(Guid.NewGuid().ToString("N"), n.NotificationId));
            if (response.Success)
            {
                _toast.ShowSuccess($"Notification {ShortId(n.NotificationId)} discarded.");
                await RefreshAll();
            }
            else
            {
                _toast.ShowError(response.ErrorMessage ?? "Discard failed.");
            }
        }
        catch (Exception ex)
        {
            _toast.ShowError($"Discard failed: {ex.Message}");
        }
        _actionInProgress = false;
    }

    private async Task ShowDetail(NotificationSummary n)
    {
        // The summary fields render immediately; Body + recipients fill in once the
        // full-detail fetch completes.
        _detailNotification = n;
        _detail = null;
        _detailError = null;
        _detailLoading = true;
        StateHasChanged();

        try
        {
            var response = await CommunicationService.GetNotificationDetailAsync(
                new NotificationDetailRequest(Guid.NewGuid().ToString("N"), n.NotificationId));
            if (response.Success && response.Detail != null)
            {
                _detail = response.Detail;
            }
            else
            {
                _detailError = response.ErrorMessage ?? "Failed to load notification detail.";
            }
        }
        catch (Exception ex)
        {
            _detailError = $"Failed to load notification detail: {ex.Message}";
        }
        _detailLoading = false;
    }

    private void CloseDetail()
    {
        _detailNotification = null;
        _detail = null;
        _detailError = null;
        _detailLoading = false;
    }

    /// <summary>
    /// Best-effort parse of <c>ResolvedTargets</c> into individual recipient addresses.
    /// The field may be a JSON string array, or a comma/semicolon-separated string.
    /// Returns an empty list when null/empty.
    /// </summary>
    private static List<string> ParseRecipients(string? resolvedTargets)
    {
        if (string.IsNullOrWhiteSpace(resolvedTargets))
        {
            return new List<string>();
        }

        var trimmed = resolvedTargets.Trim();
        if (trimmed.StartsWith('['))
        {
            try
            {
                var parsed = System.Text.Json.JsonSerializer.Deserialize<List<string>>(trimmed);
                if (parsed != null)
                {
                    return parsed
                        .Where(r => !string.IsNullOrWhiteSpace(r))
                        .Select(r => r.Trim())
                        .ToList();
                }
            }
            catch (System.Text.Json.JsonException)
            {
                // Not valid JSON — fall through to the delimiter-split path.
            }
        }

        return trimmed
            .Split(new[] { ',', ';' }, StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
            .ToList();
    }

    private async Task RetryFromDetail(NotificationSummary n)
    {
        await RetryNotification(n);
        // RefreshAll replaces the row list; close the modal so the user sees the
        // refreshed grid rather than a now-stale detail snapshot.
        CloseDetail();
    }

    private async Task DiscardFromDetail(NotificationSummary n)
    {
        await DiscardNotification(n);
        CloseDetail();
    }

    private void ClearFilters()
    {
        _statusFilter = string.Empty;
        _typeFilter = string.Empty;
        _siteFilter = string.Empty;
        _listFilter = string.Empty;
        _subjectFilter = string.Empty;
        _nodeFilter = string.Empty;
        _stuckOnly = false;
        _fromFilter = null;
        _toFilter = null;
    }

    private bool HasActiveFilters =>
        !string.IsNullOrEmpty(_statusFilter) ||
        !string.IsNullOrEmpty(_typeFilter) ||
        !string.IsNullOrEmpty(_siteFilter) ||
        !string.IsNullOrEmpty(_listFilter) ||
        !string.IsNullOrEmpty(_subjectFilter) ||
        !string.IsNullOrEmpty(_nodeFilter) ||
        _stuckOnly ||
        _fromFilter != null ||
        _toFilter != null;

    private string SiteName(string siteId) =>
        _sites.FirstOrDefault(s => s.SiteIdentifier == siteId)?.Name ?? siteId;

    private static string? NullIfEmpty(string s) => string.IsNullOrWhiteSpace(s) ? null : s.Trim();

    // CentralUI-027: <input type="datetime-local"> binds with DateTimeKind.Unspecified
    // — the value is the operator's browser-local wall-clock. Tag it as Local and
    // convert to UTC before the value enters the wire query; otherwise the From/To
    // window is silently shifted by the operator's UTC offset.
    private static DateTimeOffset? ToUtc(DateTime? local) =>
        local.HasValue
            ? new DateTimeOffset(
                DateTime.SpecifyKind(local.Value, DateTimeKind.Local).ToUniversalTime(),
                TimeSpan.Zero)
            : (DateTimeOffset?)null;

    private static string ShortId(string id) => id[..Math.Min(12, id.Length)];

    private static string StatusBadgeClass(string status) => status switch
    {
        "Delivered" => "bg-success",
        "Parked" => "bg-danger",
        "Retrying" => "bg-warning text-dark",
        "Pending" => "bg-info text-dark",
        "Discarded" => "bg-secondary",
        _ => "bg-light text-dark"
    };

    /// <summary>
    /// Drops any notification whose <c>SourceSiteId</c> resolves to a Site.Id outside
    /// the caller's permitted set. A system-wide user gets the list back unchanged.
    /// Lookup uses <c>_allSites</c> (NOT <c>_sites</c>) so a row whose Site was
    /// filtered OUT of the dropdown is correctly classified as out-of-scope.
    /// A truly unknown <c>SourceSiteId</c> (stale row from a deleted site) is kept —
    /// there is no Site.Id to gate it on.
    /// </summary>
    private Task<List<NotificationSummary>> FilterPermittedAsync(
        IEnumerable<NotificationSummary> notifications)
    {
        if (_siteScopeSystemWide)
            return Task.FromResult(notifications.ToList());

        var filtered = notifications
            .Where(n =>
            {
                var resolved = _allSites.FirstOrDefault(s => s.SiteIdentifier == n.SourceSiteId);
                return resolved is null || _permittedSiteIds.Contains(resolved.Id);
            })
            .ToList();
        return Task.FromResult(filtered);
    }

    /// <summary>
    /// Server-side re-check for the Retry/Discard relay actions. Returns true for a
    /// system-wide user, or when the row's source site resolves to a Site.Id in the
    /// caller's permitted set. An unresolvable site identifier defaults to allowed
    /// (legacy behaviour); the relay's own site-scope re-check is then the
    /// final gate.
    /// </summary>
    private bool IsRowSiteAllowedSync(string sourceSiteId)
    {
        if (_siteScopeSystemWide)
            return true;

        var resolved = _allSites.FirstOrDefault(s => s.SiteIdentifier == sourceSiteId);
        if (resolved is null)
            return true;

        return _permittedSiteIds.Contains(resolved.Id);
    }

    private Task<bool> IsRowSiteAllowedAsync(string sourceSiteId)
        => Task.FromResult(IsRowSiteAllowedSync(sourceSiteId));
}
