import { getRoleLaneFromUser } from './roleLanes'

const HIGH_TRUST_ROLE_NAMES = new Set(['Super Administrator', 'Administrator'])

export const canManagePlatformUserFields = (currentUser?: any) =>
  getRoleLaneFromUser(currentUser) === 'super_admin'

export const canManageUserRecord = (currentUser?: any, userRecord?: any) => {
  if (!currentUser?.id || !userRecord?.id) {
    return false
  }

  const currentLane = getRoleLaneFromUser(currentUser)

  if (currentLane === 'super_admin') {
    return true
  }

  if (currentLane !== 'admin') {
    return false
  }

  if (currentUser.id === userRecord.id) {
    return false
  }

  return !HIGH_TRUST_ROLE_NAMES.has(userRecord?.app_role?.name)
}

export const getUserManagementMessage = (currentUser?: any) =>
  canManagePlatformUserFields(currentUser)
    ? 'You can manage every user account, including platform-level roles and organization assignment.'
    : 'You can invite and manage concierge/customer users in your own workspace. Administrator accounts remain protected.'
