/**
 * Client Portal Permissions — role-based with per-user overrides.
 */

export type PortalRole = "viewer" | "editor" | "admin";

interface PermDef {
  label: string;
  description: string;
  defaultByRole: Record<PortalRole, boolean>;
}

export const PORTAL_PERMISSIONS: Record<string, PermDef> = {
  // Viewing
  canViewDashboard: { label: "View Dashboard", description: "See KPIs and performance data", defaultByRole: { viewer: true, editor: true, admin: true } },
  canViewReports: { label: "View Reports", description: "Access performance reports", defaultByRole: { viewer: true, editor: true, admin: true } },
  canViewRankings: { label: "View Rankings", description: "See keyword position data", defaultByRole: { viewer: true, editor: true, admin: true } },
  canViewConversions: { label: "View Conversions", description: "See conversion and attribution data", defaultByRole: { viewer: true, editor: true, admin: true } },
  canViewAudit: { label: "View Audit Results", description: "See technical audit findings", defaultByRole: { viewer: true, editor: true, admin: true } },
  // Actions
  canExportReports: { label: "Export Reports", description: "Download PDF, DOCX, PPTX reports", defaultByRole: { viewer: false, editor: true, admin: true } },
  canShareReports: { label: "Share Reports", description: "Generate shareable report links", defaultByRole: { viewer: false, editor: true, admin: true } },
  canReplyToReviews: { label: "Reply to Reviews", description: "Respond to Google reviews", defaultByRole: { viewer: false, editor: true, admin: true } },
  canRequestAnalysis: { label: "Request Analysis", description: "Trigger new AI analysis", defaultByRole: { viewer: false, editor: false, admin: true } },
  canManageUsers: { label: "Manage Users", description: "Invite or remove other client users", defaultByRole: { viewer: false, editor: false, admin: true } },
  canViewBilling: { label: "View Billing", description: "See subscription and billing info", defaultByRole: { viewer: false, editor: false, admin: true } },
};

export const ROLE_DESCRIPTIONS: Record<PortalRole, string> = {
  viewer: "Can see data but cannot export, share, or take actions",
  editor: "Can view and export data, reply to reviews, share reports",
  admin: "Full access including user management and analysis requests",
};

export function getPermissionsForRole(role: string): Record<string, boolean> {
  const r = (role as PortalRole) || "viewer";
  const perms: Record<string, boolean> = {};
  for (const [key, def] of Object.entries(PORTAL_PERMISSIONS)) {
    perms[key] = def.defaultByRole[r] ?? false;
  }
  return perms;
}

export function resolvePermissions(role: string, overrides?: Record<string, boolean> | null): Record<string, boolean> {
  const defaults = getPermissionsForRole(role);
  if (!overrides) return defaults;
  return { ...defaults, ...overrides };
}

export function hasPermission(role: string, overrides: Record<string, boolean> | null | undefined, permission: string): boolean {
  const resolved = resolvePermissions(role, overrides as Record<string, boolean> | null);
  return resolved[permission] ?? false;
}

export function permissionKeys(): string[] {
  return Object.keys(PORTAL_PERMISSIONS);
}
