/**
 * Role Types - Must match backend role definitions exactly
 *
 * This system uses TWO DISTINCT role systems for fine-grained access control:
 *
 * 1. GLOBAL USER ROLES (Auth Service):
 *    - System-wide permissions across the platform
 *    - Managed by the Auth service
 *    - Stored in the User model
 *    - Used for cross-tenant operations and platform administration
 *
 * 2. TENANT-SPECIFIC ROLES (Tenant Service):
 *    - Organization/tenant-level permissions
 *    - Managed by the Tenant service
 *    - Stored in the TenantMember model
 *    - Used for per-tenant access control and team management
 *
 * ROLE MAPPING (Tenant → Global):
 * When creating users through tenant management, tenant roles are mapped to global roles:
 *   - tenant 'admin'  → global 'admin'   (full administrative access)
 *   - tenant 'member' → global 'manager' (management-level access)
 *   - tenant 'viewer' → global 'user'    (basic user access)
 *   - tenant 'owner'  → No automatic mapping (owner is tenant-specific)
 *
 * This mapping ensures users have appropriate platform-level permissions
 * that align with their organizational role.
 */

// Global User Roles (Auth Service)
// Platform-wide roles for system-level access control
export const GLOBAL_USER_ROLES = {
  USER: 'user',           // Basic authenticated user
  ADMIN: 'admin',         // System administrator
  MANAGER: 'manager',     // Mid-level management access
  SUPER_ADMIN: 'super_admin', // Full platform access
} as const;

// Tenant-Specific Roles (Tenant Service)
// Organization-level roles for tenant-scoped operations
export const TENANT_ROLES = {
  OWNER: 'owner',     // Tenant owner (full control, can transfer ownership)
  ADMIN: 'admin',     // Tenant administrator (team management, most operations)
  MEMBER: 'member',   // Standard team member (regular operations)
  VIEWER: 'viewer',   // Read-only observer (view-only access)
} as const;

// Combined role types
export type GlobalUserRole = typeof GLOBAL_USER_ROLES[keyof typeof GLOBAL_USER_ROLES];
export type TenantRole = typeof TENANT_ROLES[keyof typeof TENANT_ROLES];
export type Role = GlobalUserRole | TenantRole;

// Role hierarchy for permission checking
export const ROLE_HIERARCHY = {
  // Global roles (highest to lowest)
  global: [
    GLOBAL_USER_ROLES.SUPER_ADMIN,
    GLOBAL_USER_ROLES.ADMIN,
    GLOBAL_USER_ROLES.MANAGER,
    GLOBAL_USER_ROLES.USER,
  ],
  // Tenant roles (highest to lowest)
  tenant: [
    TENANT_ROLES.OWNER,
    TENANT_ROLES.ADMIN,
    TENANT_ROLES.MEMBER,
    TENANT_ROLES.VIEWER,
  ],
} as const;

// Permission helper functions
export const hasGlobalRole = (userRole: string, requiredRole: GlobalUserRole): boolean => {
  const userIndex = ROLE_HIERARCHY.global.indexOf(userRole as GlobalUserRole);
  const requiredIndex = ROLE_HIERARCHY.global.indexOf(requiredRole);
  return userIndex !== -1 && requiredIndex !== -1 && userIndex <= requiredIndex;
};

export const hasTenantRole = (userRole: string, requiredRole: TenantRole): boolean => {
  const userIndex = ROLE_HIERARCHY.tenant.indexOf(userRole as TenantRole);
  const requiredIndex = ROLE_HIERARCHY.tenant.indexOf(requiredRole);
  return userIndex !== -1 && requiredIndex !== -1 && userIndex <= requiredIndex;
};

export const hasAnyRole = (userRoles: string[], requiredRoles: Role[]): boolean => {
  return requiredRoles.some(requiredRole => userRoles.includes(requiredRole));
};

// Common role combinations for easy reuse
export const ROLE_COMBINATIONS = {
  // Administrative access (global admin or tenant owner)
  ADMIN_ACCESS: [GLOBAL_USER_ROLES.ADMIN, GLOBAL_USER_ROLES.SUPER_ADMIN, TENANT_ROLES.OWNER],
  
  // Management access (admin + manager + tenant admin)
  MANAGEMENT_ACCESS: [
    GLOBAL_USER_ROLES.ADMIN,
    GLOBAL_USER_ROLES.SUPER_ADMIN,
    GLOBAL_USER_ROLES.MANAGER,
    TENANT_ROLES.OWNER,
    TENANT_ROLES.ADMIN,
  ],
  
  // Owner-only access (super admin or tenant owner)
  OWNER_ACCESS: [GLOBAL_USER_ROLES.SUPER_ADMIN, TENANT_ROLES.OWNER],
  
  // Basic access (any authenticated user with any role)
  BASIC_ACCESS: [
    ...Object.values(GLOBAL_USER_ROLES),
    ...Object.values(TENANT_ROLES),
  ],
} as const;