import type { Role } from './auth-context';

/**
 * Role-based UI gates. Mirrors the server-side role checks in
 * internal/authd/middleware.go (RequireRole) and the per-id
 * scope check in cmd/authd/tenants.go (canAccessTenant). The
 * server is always the source of truth — these helpers just
 * keep the UI from rendering buttons that the server would
 * 403 on.
 *
 * canManage*:    the user can write / change things
 * canView*:      the user can read (anyone with auth can read)
 * canAccess*:    the user can navigate to a given tenant id
 *                (super_admin always, tenant_admin only own,
 *                viewer only own if we ever allow them in)
 */

export function isSuperAdmin(role: Role | undefined | null): boolean {
  return role === 'super_admin';
}

export function isTenantAdmin(role: Role | undefined | null): boolean {
  return role === 'tenant_admin';
}

// Companies: super_admin can manage (create/edit/suspend),
// tenant_admin can read+edit-own.
export function canManageCompanies(role: Role | undefined | null): boolean {
  return role === 'super_admin';
}

export function canViewCompanies(role: Role | undefined | null): boolean {
  return role === 'super_admin' || role === 'tenant_admin';
}

// Sources: super_admin + tenant_admin can manage their own
// (added in M13b W2).
export function canManageSources(role: Role | undefined | null): boolean {
  return role === 'super_admin' || role === 'tenant_admin';
}

export function canViewSources(role: Role | undefined | null): boolean {
  return role === 'super_admin' || role === 'tenant_admin';
}

// Telegram: super_admin only (M13b W3).
export function canManageTelegram(role: Role | undefined | null): boolean {
  return role === 'super_admin';
}

export function canViewTelegram(role: Role | undefined | null): boolean {
  return role === 'super_admin';
}

// DLQ: any authenticated role can read their own.
export function canViewDLQ(role: Role | undefined | null): boolean {
  return role === 'super_admin' || role === 'tenant_admin' || role === 'viewer';
}
