/**
 * Frontend permission vocabulary (Workstream 3 §3.6 / §3.2). Mirrors the backend
 * permission names (`${VERB}_${ENTITY}`, see `backend/src/db/seeders/
 * 20200430130760-user-roles.ts`). This is UI config only — the backend remains
 * the sole authority; these names are used to gate UI affordances so the UI
 * matches what the backend will allow. Do not import backend code here.
 */

export const PERMISSION_ENTITIES = [
  'users', 'roles', 'permissions', 'organizations', 'campuses',
  'academic_years', 'grades', 'subjects', 'staff',
  'classes', 'class_enrollments', 'class_subjects', 'timetables',
  'timetable_periods', 'attendance_sessions', 'attendance_records',
  'assessments', 'assessment_results', 'messages',
  'message_recipients', 'policy_documents',
] as const;

export const PERMISSION_VERBS = ['CREATE', 'READ', 'UPDATE', 'DELETE'] as const;

export const SPECIAL_PERMISSIONS = ['READ_API_DOCS', 'CREATE_SEARCH'] as const;

/**
 * Product module/page permissions (§3.2). Read = page visibility; the three
 * actions are extra rights. Mirrors the backend module-permission catalog.
 */
export const MODULE_PERMISSIONS = [
  'READ_DASHBOARD', 'READ_FRAME', 'READ_CLASSROOM', 'READ_TIMER', 'READ_QBS',
  'READ_EI', 'READ_ZONES', 'READ_SIGNS', 'READ_ATTENDANCE', 'READ_PARENT_COMM',
  'READ_INTERNAL_COMM', 'READ_SAFETY', 'READ_HANDBOOK', 'READ_COMMUNITY',
  'READ_VOCATIONAL', 'READ_ESA', 'READ_WALKTHROUGH', 'READ_DIRECTOR_DASHBOARD',
  'FILL_ATTENDANCE', 'TAKE_QUIZ', 'ACK_READ_RECEIPT',
] as const;

export type PermissionEntity = (typeof PERMISSION_ENTITIES)[number];
export type PermissionVerb = (typeof PERMISSION_VERBS)[number];
export type CrudPermission = `${PermissionVerb}_${Uppercase<PermissionEntity>}`;
export type SpecialPermission = (typeof SPECIAL_PERMISSIONS)[number];
export type ModulePermission = (typeof MODULE_PERMISSIONS)[number];

/** Any permission name the backend may grant. */
export type PermissionName = CrudPermission | SpecialPermission | ModulePermission;
