import type { RbacAdapter, RbacResolveInput } from './index.js'

/** Role names sourced from a prior app's production role set. */
export const FLAT_ROLE_NAMES = [
  'owner',
  'admin',
  'moderator',
  'member',
  'guest',
] as const

export type FlatRoleName = (typeof FLAT_ROLE_NAMES)[number]

/** Default capability map sourced from a prior app's production permissions. */
export const DEFAULT_FLAT_ROLE_CAPABILITIES: Record<FlatRoleName, readonly string[]> = {
  owner: ['manage_settings', 'manage_users', 'moderate_posts', 'read'],
  admin: ['manage_settings', 'manage_users', 'moderate_posts', 'read'],
  moderator: ['moderate_posts', 'ban_users', 'read', 'create_post'],
  member: ['read', 'create_post', 'create_thread'],
  guest: ['read'],
}

export type FlatRbacConfig = {
  roleMap?: Record<string, readonly string[]>
}

export function createFlatRbac(config: FlatRbacConfig = {}): RbacAdapter {
  const roleMap: Record<string, readonly string[]> =
    config.roleMap ?? DEFAULT_FLAT_ROLE_CAPABILITIES

  return {
    async resolveCapabilities(input: RbacResolveInput): Promise<string[]> {
      const caps = roleMap[input.roleKey]
      if (!caps) return []
      return [...caps]
    },
  }
}