/**
 * The role permissions, one table for the server that enforces them and the
 * client that hides what a role can't do.
 *
 * @module
 */

import type { Role } from "./user.ts";

/**
 * Named capabilities checked at enforcement points. Extend this union as new
 * gated capabilities are added (e.g. "invite:manage").
 */
export type Permission =
  | "dump:moderate"
  | "comment:moderate"
  | "playlist:moderate"
  | "chat:moderate"
  | "user:manage"
  | "category:manage";

/** Every {@link Permission}. */
const ALL_PERMISSIONS: readonly Permission[] = [
  "dump:moderate",
  "comment:moderate",
  "playlist:moderate",
  "chat:moderate",
  "user:manage",
  "category:manage",
];

/**
 * What each role may do. Roles are fixed in code. `admin` is a superset of
 * every permission (current and future); `moderator` gets the
 * content-moderation permissions only.
 */
export const ROLE_PERMISSIONS: Record<Role, readonly Permission[]> = {
  admin: ALL_PERMISSIONS,
  moderator: [
    "dump:moderate",
    "comment:moderate",
    "playlist:moderate",
    "chat:moderate",
  ],
  user: [],
};

/** Checks whether `role` grants `permission`. */
export function hasPermission(role: Role, permission: Permission): boolean {
  return ROLE_PERMISSIONS[role].includes(permission);
}