import type { AdminRole, AdminUser } from "./db";

export type AdminPermission =
  | "admin.manage"
  | "admin.force_logout"
  | "admin.reset_password"
  | "security.view_audit"
  | "security.manage_reset_requests"
  | "security.manage_settings"
  | "content.view_activity"
  | "posts.create"
  | "posts.edit"
  | "posts.publish"
  | "seo.manage"
  | "media.manage"
  | "roles.manage"
  | "redirects.manage"
  | "notifications.send";

/**
 * Role-to-Permissions Mapping Matrix
 * - MAIN_ADMIN has ALL permissions unconditionally.
 * - Sub-Admin roles have specific, bounded permissions.
 */
export const ROLE_PERMISSIONS: Record<AdminRole, readonly AdminPermission[]> = {
  MAIN_ADMIN: [
    "admin.manage",
    "admin.force_logout",
    "admin.reset_password",
    "security.view_audit",
    "security.manage_reset_requests",
    "security.manage_settings",
    "content.view_activity",
    "posts.create",
    "posts.edit",
    "posts.publish",
    "seo.manage",
    "media.manage",
    "roles.manage",
    "redirects.manage",
    "notifications.send",
  ],
  CONTENT_EDITOR: [
    "content.view_activity",
    "posts.create",
    "posts.edit",
    "posts.publish",
    "media.manage",
  ],
  PUBLISHING_MANAGER: [
    "content.view_activity",
    "posts.edit",
    "posts.publish",
    "notifications.send",
  ],
  SEO_MANAGER: [
    "content.view_activity",
    "seo.manage",
  ],
  MEDIA_MANAGER: [
    "content.view_activity",
    "media.manage",
  ],
};

export interface RoleMetadata {
  id: AdminRole;
  label: string;
  description: string;
  canPublish: boolean;
  canManageSecurity: boolean;
}

export const SUB_ADMIN_ROLES: readonly RoleMetadata[] = [
  {
    id: "CONTENT_EDITOR",
    label: "Blog / Content Editor",
    description: "Create, edit, and publish blog articles and upload media. Cannot manage security or administrators.",
    canPublish: true,
    canManageSecurity: false,
  },
  {
    id: "PUBLISHING_MANAGER",
    label: "Publishing Manager",
    description: "Review, schedule, publish, and archive articles. Cannot manage users or security.",
    canPublish: true,
    canManageSecurity: false,
  },
  {
    id: "SEO_MANAGER",
    label: "SEO Manager",
    description: "Manage search engine optimization tags, metadata, structured schema, and OpenGraph.",
    canPublish: false,
    canManageSecurity: false,
  },
  {
    id: "MEDIA_MANAGER",
    label: "Media Manager",
    description: "Upload, curate, and optimize brand media assets, covers, and illustrations.",
    canPublish: false,
    canManageSecurity: false,
  },
];

/**
 * Check if a given role possesses a specific permission.
 */
export function hasPermission(role: string, permission: AdminPermission, customPermissions?: string[]): boolean {
  if (role === "MAIN_ADMIN") return true;
  if (customPermissions) {
    return customPermissions.includes(permission);
  }
  const permissions = ROLE_PERMISSIONS[role as AdminRole];
  return permissions ? permissions.includes(permission) : false;
}

/**
 * Synchronous permission check supporting predefined roles and optional custom permissions list.
 */
export function userHasPermission(
  user: AdminUser | null | undefined,
  permission: AdminPermission,
  customPermissions?: string[]
): boolean {
  if (!user || user.status !== "ACTIVE") return false;
  if (user.level === "MAIN_ADMIN" || user.role === "MAIN_ADMIN") return true;
  return hasPermission(user.role, permission, customPermissions);
}

/**
 * Return all permissions assigned to a user (predefined roles).
 */
export function getUserPermissions(user: AdminUser): AdminPermission[] {
  if (user.level === "MAIN_ADMIN" || user.role === "MAIN_ADMIN") {
    return [...ROLE_PERMISSIONS.MAIN_ADMIN];
  }
  return [...(ROLE_PERMISSIONS[user.role as AdminRole] || [])];
}