import type { Role } from "@prisma/client";

// ─── Permission model ─────────────────────────────────────────────────────────
// Encodes the Access Control Matrix from the spec. Each permission maps to the
// set of roles allowed to perform it. Server routes AND the UI both consult this
// so behaviour stays consistent.

export type Permission =
  | "system:settings" // System settings & app logs
  | "users:manage" // Manage users & staff positions
  | "kpis:write" // Add/edit department KPI indicators
  | "kpis:read" // View KPI indicators
  | "companies:write" // Add/edit companies (department KPI owners)
  | "departments:write" // Add/edit departments (functional teams)
  | "financials:write" // Enter monthly budget/spend/revenue/funnel figures
  | "channels:write" // Add/edit marketing channels
  | "platforms:write" // Add/edit social-media platforms
  | "tasks:manageAll" // Manage/intervene in ALL staff tasks
  | "tasks:logOwn" // Log personal weekly tasks
  | "posts:read" // View scheduled posts
  | "posts:author" // Create/edit own posts, submit, mark posted
  | "posts:approve" // Approve / reject submitted posts
  | "appraisals:manage" // Create/edit/finalize staff appraisals
  | "appraisals:read" // View own appraisals & self-assess
  | "dashboard:viewTeam" // View team-wide dashboard/reports
  | "dashboard:viewOwn"; // View own dashboard

const MATRIX: Record<Permission, Role[]> = {
  "system:settings": ["SUPER_ADMIN"],
  "users:manage": ["SUPER_ADMIN", "ADMIN"],
  "kpis:write": ["SUPER_ADMIN", "ADMIN", "MANAGER"],
  "kpis:read": ["SUPER_ADMIN", "ADMIN", "MANAGER", "STAFF"],
  "companies:write": ["SUPER_ADMIN", "ADMIN", "MANAGER"],
  "departments:write": ["SUPER_ADMIN", "ADMIN", "MANAGER"],
  "financials:write": ["SUPER_ADMIN", "ADMIN", "MANAGER"],
  "channels:write": ["SUPER_ADMIN", "ADMIN", "MANAGER"],
  "platforms:write": ["SUPER_ADMIN", "ADMIN", "MANAGER"],
  "tasks:manageAll": ["SUPER_ADMIN", "ADMIN", "MANAGER"],
  "tasks:logOwn": ["SUPER_ADMIN", "ADMIN", "MANAGER", "STAFF"],
  "posts:read": ["SUPER_ADMIN", "ADMIN", "MANAGER", "STAFF"],
  "posts:author": ["SUPER_ADMIN", "ADMIN", "MANAGER", "STAFF"],
  "posts:approve": ["SUPER_ADMIN", "ADMIN", "MANAGER"],
  "appraisals:manage": ["SUPER_ADMIN", "ADMIN", "MANAGER"],
  "appraisals:read": ["SUPER_ADMIN", "ADMIN", "MANAGER", "STAFF"],
  "dashboard:viewTeam": ["SUPER_ADMIN", "ADMIN", "MANAGER"],
  "dashboard:viewOwn": ["SUPER_ADMIN", "ADMIN", "MANAGER", "STAFF"],
};

export function can(role: Role | undefined | null, perm: Permission): boolean {
  if (!role) return false;
  return MATRIX[perm].includes(role);
}

/** Roles that can act on/see other people's data (admin tier). */
export function isManagerTier(role: Role | undefined | null): boolean {
  return !!role && ["SUPER_ADMIN", "ADMIN", "MANAGER"].includes(role);
}

export const ROLE_LABELS: Record<Role, string> = {
  SUPER_ADMIN: "Super Admin",
  ADMIN: "Admin",
  MANAGER: "Manager",
  STAFF: "Staff",
};

// Default marketing positions used when creating Staff users. Admins can type a
// custom value too; this just seeds the dropdown.
export const MARKETING_POSITIONS = [
  "SEO Specialist",
  "Content Creator",
  "Performance Marketer",
  "Copywriter",
  "Media Buyer",
  "Social Media Manager",
  "Graphic Designer",
  "Email Marketer",
] as const;
