/**
 * Roles the Ed25519 JWT `role` claim is expected to carry (see docs/AUTH.md
 * §JWT Claims). Ordered highest-to-lowest privilege; PermissionService does
 * not rely on the order, it is documentation only.
 */
export type AdminRole = 'Owner' | 'Administrator' | 'Editor' | 'Support' | 'ReadOnly';

/**
 * Coarse-grained permission keys. Intentionally small and domain-agnostic
 * (mirrors the existing bootstrap-level `PermissionsConfig` shape in
 * `shared/models/config/permissions.model.ts`) - fine-grained, per-domain
 * permissions stay server-side until the backend ships a real permission
 * model; the frontend only needs enough to hide/disable UI, never to be the
 * source of truth for authorization.
 */
export type Permission =
  | 'backoffice.read'
  | 'backoffice.write'
  | 'builder.read'
  | 'builder.write'
  | 'users.manage'
  | 'settings.manage';

export const ROLE_PERMISSIONS: Readonly<Record<AdminRole, readonly Permission[]>> = {
  Owner: ['backoffice.read', 'backoffice.write', 'builder.read', 'builder.write', 'users.manage', 'settings.manage'],
  Administrator: ['backoffice.read', 'backoffice.write', 'builder.read', 'builder.write', 'users.manage'],
  Editor: ['backoffice.read', 'backoffice.write', 'builder.read', 'builder.write'],
  Support: ['backoffice.read'],
  ReadOnly: ['backoffice.read', 'builder.read']
};

export function isAdminRole(value: unknown): value is AdminRole {
  return typeof value === 'string' && value in ROLE_PERMISSIONS;
}
