import { PrismaClient } from '@prisma/client';

/**
 * Creates a tenant-scoped Prisma client that sets the app.current_tenant
 * PostgreSQL session variable before every query via RLS.
 *
 * Uses parameterized set_config to prevent SQL injection (T-02-05).
 */
export function forTenant(prisma: PrismaClient, tenantId: string) {
  return prisma.$extends({
    query: {
      $allOperations({ args, query }: { args: any; query: (args: any) => any }) {
        return (prisma as any).$transaction(async (tx: any) => {
          // Use parameterized query to avoid SQL injection
          await tx.$executeRawUnsafe(
            `SELECT set_config('app.current_tenant', $1, true)`,
            tenantId,
          );
          return query(args);
        });
      },
    },
  });
}