/**
 * 全局权限点常量（coord 维护）
 *
 * 命名规范（F7 裁决）：<RESOURCE>_<ACTION>[_<SCOPE>]
 * - RESOURCE：大写资源名（USER/ROLE/CLASS/EXAM...）
 * - ACTION：动作（CREATE/READ/UPDATE/DELETE/MANAGE...）
 * - SCOPE（可选）：作用域（OWN/CLASS/GRADE/SCHOOL...）
 *
 * 维护方：
 * - ADMIN_* → coord 维护（本文件）
 * - IAM_* → iam 服务维护
 * - ORG_* → iam 服务维护
 * - CORE_EDU_* → core-edu 服务维护
 * - CONTENT_* → content 服务维护
 * - MSG_* → msg 服务维护
 *
 * 引用：
 * - admin-portal_contract.md §1.2：admin-portal 路由权限点
 * - ARB-021 §23.4：admin 命名空间 schema
 * - coord-final-decisions F7：权限点命名规范
 */

// ============ ADMIN_* 权限点（admin-portal 专用） ============
// 来源：admin-portal_contract.md §1.2 + ARB-021 §23.4
// 维护方：coord

export const ADMIN_PERMISSIONS = {
  /** 管理员仪表盘查看 */
  ADMIN_DASHBOARD_VIEW: "ADMIN_DASHBOARD_VIEW",
  /** 学校设置管理（L5 校级） */
  ADMIN_SYSTEM_MANAGE: "ADMIN_SYSTEM_MANAGE",
  /** 班级管理-全局查看（跨班级） */
  ADMIN_CLASS_READ: "ADMIN_CLASS_READ",
  /** 班级管理-全局编辑（跨班级） */
  ADMIN_CLASS_MANAGE: "ADMIN_CLASS_MANAGE",
  /** 教师管理-查看 */
  ADMIN_TEACHER_READ: "ADMIN_TEACHER_READ",
  /** 教师管理-编辑 */
  ADMIN_TEACHER_MANAGE: "ADMIN_TEACHER_MANAGE",
  /** 学生管理-查看 */
  ADMIN_STUDENT_READ: "ADMIN_STUDENT_READ",
  /** 学生管理-编辑 */
  ADMIN_STUDENT_MANAGE: "ADMIN_STUDENT_MANAGE",
  /** 审计日志查看（L5 校级） */
  ADMIN_AUDIT_READ: "ADMIN_AUDIT_READ",
  /** 审计日志导出 */
  ADMIN_AUDIT_EXPORT: "ADMIN_AUDIT_EXPORT",
} as const;

export type AdminPermission = keyof typeof ADMIN_PERMISSIONS;

export const ADMIN_PERMISSION_VALUES: readonly string[] =
  Object.values(ADMIN_PERMISSIONS);

/** admin 角色全权限通配符 */
export const ADMIN_WILDCARD = "*";

/** admin-portal 所有路由权限点映射 */
export const ADMIN_ROUTE_PERMISSIONS: Record<string, string> = {
  "/admin/dashboard": ADMIN_PERMISSIONS.ADMIN_DASHBOARD_VIEW,
  "/admin/users": "IAM_USER_READ", // 复用 iam 权限点
  "/admin/roles": "IAM_ROLE_READ", // 复用 iam 权限点
  "/admin/permissions": "IAM_PERMISSION_READ", // 复用 iam 权限点
  "/admin/viewports": "IAM_VIEWPORT_READ", // 复用 iam 权限点
  "/admin/organization": "ORG_MANAGE", // 复用 iam 权限点
  "/admin/system": ADMIN_PERMISSIONS.ADMIN_SYSTEM_MANAGE,
  "/admin/classes": ADMIN_PERMISSIONS.ADMIN_CLASS_READ,
  "/admin/teachers": ADMIN_PERMISSIONS.ADMIN_TEACHER_READ,
  "/admin/students": ADMIN_PERMISSIONS.ADMIN_STUDENT_READ,
  "/admin/audit-logs": ADMIN_PERMISSIONS.ADMIN_AUDIT_READ,
} as const;

// ============ 权限点分组（admin-portal §2.4 GraphQL adminPermissions Query 用） ============

export interface PermissionGroup {
  resource: string;
  label: string;
  permissions: string[];
}

/** 全量权限点分组（admin-portal GraphQL adminPermissions Query 返回） */
export const PERMISSION_GROUPS: PermissionGroup[] = [
  {
    resource: "ADMIN",
    label: "管理员",
    permissions: [...ADMIN_PERMISSION_VALUES],
  },
  {
    resource: "IAM",
    label: "身份与访问",
    permissions: [
      "IAM_USER_READ",
      "IAM_USER_CREATE",
      "IAM_USER_UPDATE",
      "IAM_USER_DELETE",
      "IAM_ROLE_READ",
      "IAM_ROLE_MANAGE",
      "IAM_PERMISSION_READ",
      "IAM_VIEWPORT_READ",
      "IAM_VIEWPORT_MANAGE",
    ],
  },
  {
    resource: "ORG",
    label: "组织",
    permissions: ["ORG_MANAGE"],
  },
];