import { DomainError } from "../../shared/errors.ts";

export const Permissions = {
  DashboardView: "admin.dashboard.view",
  KycReview: "admin.kyc.review",
  KycEvidenceView: "admin.kyc.evidence.view",
  UsersManage: "admin.users.manage",
  PaymentsManage: "admin.payments.manage",
  PayoutsManage: "admin.payouts.manage",
  ListingsModerate: "admin.listings.moderate",
  DisputesResolve: "admin.disputes.resolve",
  ConfigurationManage: "admin.configuration.manage",
  StaffManage: "admin.staff.manage",
  RolesManage: "admin.roles.manage",
} as const;

export type Permission = typeof Permissions[keyof typeof Permissions];

export interface StaffPrincipal {
  readonly staffId: string;
  readonly active: boolean;
  readonly permissions: ReadonlySet<Permission>;
}

export function authorize(principal: StaffPrincipal | null, required: Permission): void {
  if (!principal?.active) throw new DomainError("UNAUTHENTICATED", "Authentication required.");
  if (!principal.permissions.has(required)) throw new DomainError("FORBIDDEN", "Permission denied.");
}