// Shared permission utilities — safe to import in both server and client components.
// Does NOT import anything from next/headers or supabase/server.

export type RoleCode = 'masteradmin' | 'admin' | 'consultant' | 'readonly' | 'extern'

export interface UserSession {
  userId: string
  authUserId: string
  roleId: string
  role: RoleCode
  permissions: string[]
  displayName: string
  firstName: string
  lastName: string
  email: string
  avatarUrl: string | null
  departmentId: string | null
  mustChangePassword: boolean
  accountStatus: string
}

const ROLE_HIERARCHY: Record<RoleCode, number> = {
  extern:      0,
  readonly:    1,
  consultant:  2,
  admin:       3,
  masteradmin: 4,
}

export function hasPermission(session: UserSession, permission: string): boolean {
  return session.permissions.includes(permission)
}

export function hasAnyPermission(session: UserSession, permissions: string[]): boolean {
  return permissions.some((p) => session.permissions.includes(p))
}

export function hasAllPermissions(session: UserSession, permissions: string[]): boolean {
  return permissions.every((p) => session.permissions.includes(p))
}

export function isAtLeastRole(session: UserSession, minimumRole: RoleCode): boolean {
  return ROLE_HIERARCHY[session.role] >= ROLE_HIERARCHY[minimumRole]
}

export function canManageUser(actor: UserSession, targetRole: RoleCode): boolean {
  switch (actor.role) {
    case 'masteradmin':
      return true
    case 'admin':
      return targetRole !== 'masteradmin'
    case 'consultant':
      return targetRole === 'consultant'
    case 'readonly':
    case 'extern':
      return false
  }
}