// ──────────────────────────────────────────────────────────────────────────
// RBAC-Katalog — zentrale, typsichere Definition aller Module, Berechtigungen
// und Rollen. Wird vom Seed (DB) und zur Laufzeit (Checks) gemeinsam genutzt.
// ──────────────────────────────────────────────────────────────────────────

export const MODULES = {
  dashboard: "Dashboard",
  chat: "Chat",
  kanban: "Kanbanboard",
  projects: "Projekte",
  creators: "Creator-Datenbank",
  time: "Arbeitszeit",
  absences: "Urlaub & Abwesenheiten",
  calendar: "Kalender",
  meetings: "Meetings",
  vault: "Passwortmanager",
  cloud: "Cloud-Speicher",
  changelog: "Protokolle & Changelogs",
  forms: "Ausschreibungen & Bewerbungen",
  contact: "Kontaktanfragen",
  admin: "Administration",
} as const;

export type ModuleKey = keyof typeof MODULES;

// Alle Berechtigungen. Schlüssel-Konvention: "<modul>.<aktion>".
// Granular je Modul, damit Rollen fein zugeschnitten werden können.
export const PERMISSIONS = {
  "dashboard.view": { module: "dashboard", description: "Dashboard ansehen" },

  "chat.view": { module: "chat", description: "Chats lesen" },
  "chat.send": { module: "chat", description: "Nachrichten senden" },
  "chat.create_channel": { module: "chat", description: "Kanäle erstellen" },

  "kanban.view": { module: "kanban", description: "Kanbanboards ansehen" },
  "kanban.manage": { module: "kanban", description: "Aufgaben verwalten (nutzen)" },
  "kanban.comment": { module: "kanban", description: "Aufgaben kommentieren" },
  "kanban.create_board": { module: "kanban", description: "Neue Boards erstellen" },

  "projects.view": { module: "projects", description: "Projekte ansehen" },
  "projects.manage": { module: "projects", description: "Projekte bearbeiten" },
  "projects.create": { module: "projects", description: "Projekte anlegen & löschen" },

  "creators.view": { module: "creators", description: "Creator ansehen" },
  "creators.manage": { module: "creators", description: "Creator verwalten" },

  "time.view": { module: "time", description: "Arbeitszeit-Modul sehen" },
  "time.track": { module: "time", description: "Eigene Zeit erfassen" },
  "time.view_all": { module: "time", description: "Zeiten aller Personen sehen" },
  "time.approve": { module: "time", description: "Zeiten freigeben" },

  "absences.view": { module: "absences", description: "Abwesenheits-Modul sehen" },
  "absences.request": { module: "absences", description: "Abwesenheit beantragen" },
  "absences.view_all": { module: "absences", description: "Team-Abwesenheiten sehen" },
  "absences.approve": { module: "absences", description: "Anträge genehmigen" },

  "calendar.view": { module: "calendar", description: "Kalender ansehen" },
  "calendar.manage": { module: "calendar", description: "Kalendereinträge verwalten" },

  "meetings.view": { module: "meetings", description: "Meetings ansehen" },
  "meetings.manage": { module: "meetings", description: "Meetings verwalten" },
  "meetings.create": { module: "meetings", description: "Meetings ansetzen" },

  "vault.view": { module: "vault", description: "Passwortmanager öffnen (eigene & freigegebene Zugangsdaten)" },
  "vault.manage": { module: "vault", description: "Zugangsdaten anlegen, bearbeiten & löschen" },
  "vault.share": { module: "vault", description: "Zugangsdaten an Personen, Teams & Rollen freigeben" },
  "vault.view_all": { module: "vault", description: "Alle Zugangsdaten einsehen (Revision)" },

  "cloud.view": { module: "cloud", description: "Cloud-Speicher öffnen" },
  "cloud.manage": { module: "cloud", description: "Dateien hochladen & verwalten" },

  "changelog.view": { module: "changelog", description: "Protokolle & Changelogs ansehen" },
  "changelog.manage": { module: "changelog", description: "Protokolle anlegen und Einträge pflegen" },

  "forms.view": { module: "forms", description: "Ausschreibungen & eingegangene Bewerbungen ansehen" },
  "forms.manage": { module: "forms", description: "Ausschreibungen pflegen, Bewerbungen bearbeiten" },

  "contact.view": { module: "contact", description: "Kontaktanfragen der Website lesen" },
  "contact.manage": { module: "contact", description: "Kontaktanfragen bearbeiten & löschen" },

  "admin.access": { module: "admin", description: "Adminbereich öffnen" },
  "admin.users": { module: "admin", description: "Personalverwaltung (Nutzer)" },
  "admin.roles": { module: "admin", description: "Rollen & Rechte verwalten" },
  "admin.teams": { module: "admin", description: "Teams verwalten" },
  "admin.settings": { module: "admin", description: "Systemeinstellungen" },
} as const;

export type PermissionKey = keyof typeof PERMISSIONS;

export const ALL_PERMISSION_KEYS = Object.keys(PERMISSIONS) as PermissionKey[];

// Rollen-Definitionen. `rank`: niedriger = höhere Befugnis.
export const ROLES = {
  ADMIN: {
    name: "Admin",
    rank: 0,
    description: "Vollzugriff auf alle Module und Systemeinstellungen.",
  },
  LEITUNG: {
    name: "Leitung",
    rank: 10,
    description: "Organisationsweite Leitung inkl. Freigaben.",
  },
  PROJEKTLEITUNG: {
    name: "Projektleitung",
    rank: 20,
    description: "Verantwortlich für Projekte, Aufgaben und Meetings.",
  },
  CREATOR_MANAGER: {
    name: "Creator-Manager",
    rank: 30,
    description: "Betreuung der Creator-Datenbank und Onboarding.",
  },
  TEAMMITGLIED: {
    name: "Teammitglied",
    rank: 40,
    description: "Standardzugriff für Mitarbeitende.",
  },
  EINGESCHRAENKT: {
    name: "Eingeschränkt",
    rank: 90,
    description: "Minimaler Zugriff — Vorbereitung für Creator-Logins.",
  },
} as const;

export type RoleKey = keyof typeof ROLES;

// Wildcard "*" => alle Berechtigungen.
export const ROLE_PERMISSIONS: Record<RoleKey, PermissionKey[] | ["*"]> = {
  ADMIN: ["*"],
  LEITUNG: [
    "dashboard.view",
    "chat.view",
    "chat.send",
    "chat.create_channel",
    "kanban.view",
    "kanban.manage",
    "kanban.comment",
    "kanban.create_board",
    "projects.view",
    "projects.manage",
    "projects.create",
    "creators.view",
    "creators.manage",
    "time.view",
    "time.track",
    "time.view_all",
    "time.approve",
    "absences.view",
    "absences.request",
    "absences.view_all",
    "absences.approve",
    "calendar.view",
    "calendar.manage",
    "meetings.view",
    "meetings.manage",
    "meetings.create",
    "vault.view",
    "vault.manage",
    "vault.share",
    "cloud.view",
    "cloud.manage",
    "changelog.view",
    "changelog.manage",
    "forms.view",
    "forms.manage",
    "contact.view",
    "contact.manage",
  ],
  PROJEKTLEITUNG: [
    "dashboard.view",
    "chat.view",
    "chat.send",
    "chat.create_channel",
    "kanban.view",
    "kanban.manage",
    "kanban.comment",
    "kanban.create_board",
    "projects.view",
    "projects.manage",
    "projects.create",
    "creators.view",
    "time.view",
    "time.track",
    "time.view_all",
    "time.approve",
    "absences.view",
    "absences.request",
    "absences.view_all",
    "absences.approve",
    "calendar.view",
    "meetings.view",
    "meetings.manage",
    "meetings.create",
    "vault.view",
    "vault.manage",
    "vault.share",
    "cloud.view",
    "cloud.manage",
    "changelog.view",
    "changelog.manage",
    "forms.view",
    "forms.manage",
    "contact.view",
    "contact.manage",
  ],
  CREATOR_MANAGER: [
    "dashboard.view",
    "chat.view",
    "chat.send",
    "chat.create_channel",
    "kanban.view",
    "kanban.manage",
    "kanban.comment",
    "projects.view",
    "creators.view",
    "creators.manage",
    "time.view",
    "time.track",
    "absences.view",
    "absences.request",
    "calendar.view",
    "meetings.view",
    "meetings.create",
    "vault.view",
    "vault.manage",
    "cloud.view",
    "cloud.manage",
    "changelog.view",
    "forms.view",
    "forms.manage",
    "contact.view",
    "contact.manage",
  ],
  TEAMMITGLIED: [
    "dashboard.view",
    "chat.view",
    "chat.send",
    "chat.create_channel",
    "kanban.view",
    "kanban.manage",
    "kanban.comment",
    "projects.view",
    "creators.view",
    "time.view",
    "time.track",
    "absences.view",
    "absences.request",
    "calendar.view",
    "meetings.view",
    "vault.view",
    "vault.manage",
    "cloud.view",
    "cloud.manage",
    "changelog.view",
    // Bewerbungen enthalten personenbezogene Daten Außenstehender: sehen ja,
    // bearbeiten nur die Leitungsrollen. In der Rollenverwaltung änderbar.
    "forms.view",
    // Kontaktanfragen sind allgemeine Anfragen — die darf jeder beantworten.
    "contact.view",
    "contact.manage",
  ],
  EINGESCHRAENKT: [
    "dashboard.view",
    "chat.view",
    "chat.send",
    "kanban.view",
    "kanban.comment",
    "time.view",
    "time.track",
    "absences.view",
    "absences.request",
    "calendar.view",
    "vault.view",
    "cloud.view",
    "changelog.view",
  ],
};

/** Löst Wildcards auf und liefert die konkreten Berechtigungen einer Rolle. */
export function resolveRolePermissions(role: RoleKey): PermissionKey[] {
  const perms = ROLE_PERMISSIONS[role];
  if (perms[0] === "*") return [...ALL_PERMISSION_KEYS];
  return perms as PermissionKey[];
}