import { Injectable, computed, inject } from '@angular/core';
import { Permission, ROLE_PERMISSIONS } from '../models/permission.model';
import { SessionService } from './session.service';

/**
 * Derives the current admin's permission set from their JWT `role` claim.
 * UI-only gate (hide/disable) - the backend must independently enforce
 * every mutation server-side; see docs/AUTH.md security considerations.
 */
@Injectable({ providedIn: 'root' })
export class PermissionService {
  private readonly session = inject(SessionService);

  readonly permissions = computed<readonly Permission[]>(() => {
    const role = this.session.role();
    return role ? ROLE_PERMISSIONS[role] : [];
  });

  has(permission: Permission): boolean {
    return this.permissions().includes(permission);
  }

  hasAny(permissions: readonly Permission[]): boolean {
    return permissions.some(permission => this.has(permission));
  }
}
