const EMPLOYEE_BASE_PERMISSIONS = [
  "expense.create",
  "expense.view_own",
  "expense.edit_own",
  "expense.delete_own",
  "expense.submit",
  "expense.withdraw",
  "invoice.upload",
  "invoice.view_own",
  "expense.proxy_manage",
] as const;

const ROLE_PERMISSIONS: Record<string, readonly string[]> = {
  employee: EMPLOYEE_BASE_PERMISSIONS,
  manager: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    "expense.approve",
    "expense.transfer",
    "expense.view_all",
  ],
  ceo: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    "expense.approve",
    "expense.transfer",
    "expense.view_all",
  ],
  finance: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    "invoice.manage",
    "expense.approve",
    "expense.finance.pay",
    "expense.view_all",
  ],
  finance_mgr: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    "invoice.manage",
    "expense.approve",
    "expense.finance.pay",
    "expense.view_all",
    "expense.finance.override_duplicate",
    "system.settings",
    "system.audit.view",
  ],
  administration: ["expense.proxy_submit", "expense.view_own"],
  hr: ["system.users", "expense.view_all"],
  admin: ["*"],
};

function rolePermissions(roleCode: string): readonly string[] {
  return ROLE_PERMISSIONS[roleCode] ?? [];
}

export function resolvePermissionsForRoles(roleCodes: string[]) {
  const permissions = new Set<string>();

  for (const roleCode of roleCodes) {
    for (const permission of rolePermissions(roleCode)) {
      permissions.add(permission);
    }
  }

  return Array.from(permissions);
}

export function hasPermission(permissionCodes: string[], permissionCode: string) {
  return permissionCodes.includes("*") || permissionCodes.includes(permissionCode);
}

export function hasAnyPermission(permissionCodes: string[], candidates: string[]) {
  if (candidates.length === 0) {
    return true;
  }

  return candidates.some((candidate) => hasPermission(permissionCodes, candidate));
}