/**
 * Canonical permission-key seed list — foundation-auth-rbac.
 * Every key is transcribed verbatim from the spec; downstream specs lock to
 * these strings. Grouped by module for readability; the flat array is authoritative.
 */
export const PERMISSION_KEYS = [
  // Tasks
  'tasks:read', 'tasks:write', 'tasks:delete', 'tasks:assign',
  // Projects
  'projects:read', 'projects:write', 'projects:delete',
  // Customers
  'customers:read', 'customers:write', 'customers:delete',
  // Invoices
  'invoices:read', 'invoices:write', 'invoices:delete', 'invoices:send', 'invoices:void',
  // Inventory
  'inventory:read', 'inventory:write', 'inventory:manage',
  // Contracts
  'contracts:read', 'contracts:write', 'contracts:delete',
  // Expenses
  'expenses:read', 'expenses:write', 'expenses:delete', 'expenses:approve',
  // Vendors
  'vendors:read', 'vendors:write',
  // Field permissions (settings only)
  'permissions:write',
  // Billing
  'billing:read', 'billing:manage',
  // Time tracking
  'time:read', 'time:read_all', 'time:write', 'time:write_all', 'time:track', 'time:manage',
  // Support / CRM
  'tickets:read', 'tickets:write', 'tickets:delete', 'tickets:assign', 'tickets:resolve',
  // Knowledge Base
  'kb:read', 'kb:write', 'kb:delete', 'kb:share', 'kb:publish',
  // Marketing
  'marketing:read', 'marketing:write',
  // Reports & Analytics
  'reports:read', 'reports:write', 'reports:export', 'reports:export_external',
  // Accountant export
  'accountant:export',
  // Settings
  'settings:read', 'settings:write',
  'settings:security:read', 'settings:security:write',
  'settings:modules:read', 'settings:modules:write',
  // Users
  'users:read', 'users:invite', 'users:manage', 'users:freeze',
  // Payouts
  'payouts:read', 'payouts:write', 'payouts:manage',
  // Calendar
  'calendar:read', 'calendar:write', 'calendar:connect',
  // Webhooks / API
  'webhooks:read', 'webhooks:manage',
  // Audit & Compliance
  'audit:read',
] as const

export type PermissionKey = (typeof PERMISSION_KEYS)[number]

/** Names of the built-in system roles seeded per tenant. */
export const SYSTEM_ROLE_NAMES = ['OWNER', 'ADMIN', 'MEMBER', 'VIEWER', 'CONTRACTOR', 'ACCOUNTANT'] as const
export type SystemRoleName = (typeof SYSTEM_ROLE_NAMES)[number]

const ALL = PERMISSION_KEYS as readonly string[]
const READ_ONLY = ALL.filter((k) => k.endsWith(':read'))

/**
 * Default permission matrix for the built-in system roles.
 *  - OWNER: every permission.
 *  - ADMIN: all except billing:manage and users:manage (user deletion).
 *  - MEMBER: operational task, contract, time, inventory, KB, and ticket access.
 *  - VIEWER: read-only across all modules (every *:read key).
 *  - CONTRACTOR: time read/track, tasks read (row-scoped downstream).
 *  - ACCOUNTANT: financial read + export permissions only.
 */
export const SYSTEM_ROLE_PERMISSIONS: Record<SystemRoleName, readonly string[]> = {
  OWNER: ALL,
  ADMIN: ALL.filter((k) => k !== 'billing:manage' && k !== 'users:manage'),
  MEMBER: [
    'tasks:read', 'tasks:write', 'projects:read',
    'contracts:read', 'contracts:write',
    'time:read', 'time:write', 'time:track',
    'inventory:read', 'inventory:write',
    'kb:read',
    'tickets:read', 'tickets:write',
  ],
  VIEWER: READ_ONLY,
  CONTRACTOR: ['time:read', 'time:write', 'time:track', 'tasks:read'],
  ACCOUNTANT: ['reports:read', 'reports:export', 'accountant:export', 'inventory:read'],
}