// ============================================================================
// ROLES & PERMISSIONS DEFINITIONS
// (Ported verbatim from fe0/src/lib/permissions.ts — the authoritative client RBAC map.)
// ============================================================================

export type Role = 'admin' | 'editor' | 'viewer';

export type Permission =
  // Dashboard
  | 'dashboard.access'
  // Application Forms
  | 'application.view'
  | 'application.edit'
  | 'application.verify'   // Admin & Viewer - verify content with vector similarity
  | 'application.approve'  // Admin only - approve to editor
  // Evaluation Tab
  | 'evaluation.view'      // Admin & Editor only
  // Chat Assistant
  | 'chat.view'            // View assistant comments
  | 'chat.interact'        // Full interaction with chatbot
  // Curriculum
  | 'curriculum.view'
  | 'curriculum.edit'
  | 'curriculum.delete'
  // Admin Panel
  | 'admin.access'
  | 'admin.users'
  | 'admin.settings'
  // ImageHub datasets
  | 'dataset.view'
  | 'dataset.create'
  | 'dataset.edit'
  | 'dataset.view_all'     // admin only — the clinical data repository (every dataset)
  // General
  | 'reports.view'
  | 'reports.create'
  | 'reports.edit';

// Role to permissions mapping
// Người nộp đơn (Viewer): Can EDIT applications, CAN verify with vector similarity, CAN see chatbot for verification results, NO evaluation tab
// Hội đồng (Editor): Can VIEW applications (read-only), sees assistant comments, NO verify button, CAN see evaluation tab
// Admin: Can VIEW applications, CAN verify, CAN approve to editor, full access
export const ROLE_PERMISSIONS: Record<Role, Permission[]> = {
  admin: [
    'dashboard.access',
    'application.view',
    'application.verify',
    'application.approve',
    'evaluation.view',
    'chat.view',
    'chat.interact',
    'curriculum.view',
    'curriculum.edit',
    'curriculum.delete',
    'admin.access',
    'admin.users',
    'admin.settings',
    'dataset.view',
    'dataset.create',
    'dataset.edit',
    'dataset.view_all',      // admin: clinical data repository (all datasets)
    'reports.view',
    'reports.create',
    'reports.edit',
  ],
  editor: [
    'dashboard.access',
    'application.view',      // View only, no edit
    'evaluation.view',       // Can see evaluation tab
    'chat.view',             // Can see assistant comments (read-only)
    'curriculum.view',
    'curriculum.edit',
    'dataset.view',          // ImageHub: manage own research data
    'dataset.create',
    'dataset.edit',
    'reports.view',
    'reports.create',
    'reports.edit',
  ],
  viewer: [
    'dashboard.access',
    'application.view',
    'application.edit',      // Viewer can EDIT applications
    'application.verify',    // Viewer can verify with vector similarity
    'chat.view',            // Viewer can see chatbot for verification results
    'curriculum.view',
    'dataset.view',          // ImageHub: team members manage their research data
    'dataset.create',
    'dataset.edit',
    'reports.view',
    // NO evaluation.view - cannot see evaluation tab
  ],
};

export function getPermissionsForRole(role: Role): Permission[] {
  return ROLE_PERMISSIONS[role] || [];
}

export function getPermissionsForRoles(roles: Role[]): Permission[] {
  const permissions = new Set<Permission>();
  roles.forEach((role) => {
    getPermissionsForRole(role).forEach((perm) => permissions.add(perm));
  });
  return Array.from(permissions);
}

export function hasPermission(roles: Role[], permission: Permission): boolean {
  return roles.some((role) => ROLE_PERMISSIONS[role]?.includes(permission));
}

export function hasAnyPermission(roles: Role[], permissions: Permission[]): boolean {
  return permissions.some((perm) => hasPermission(roles, perm));
}

export function hasAllPermissions(roles: Role[], permissions: Permission[]): boolean {
  return permissions.every((perm) => hasPermission(roles, perm));
}

export const ROLE_DISPLAY_NAMES: Record<Role, string> = {
  admin: 'Quản trị viên',
  editor: 'Hội đồng',
  viewer: 'Người nộp đơn',
};

export function getRoleDisplayName(role: Role): string {
  return ROLE_DISPLAY_NAMES[role] || role;
}
