"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.isSuperAdmin = isSuperAdmin;
exports.isGroupAdmin = isGroupAdmin;
exports.canManageRole = canManageRole;
const db_1 = require("../../lib/db");
const roles_1 = require("./roles");
const sql_1 = require("./sql");
// ─── RBAC helpers ─────────────────────────────────────────────────────────────
/**
 * Is the user a superadmin? (global — can manage all users and roles)
 */
async function isSuperAdmin(userId) {
    return (0, roles_1.hasRoleType)(userId, 'superadmin');
}
/**
 * Is the user an admin of a specific role group?
 * Returns true if the user has `type = 'admin'` or `type = 'superadmin'` for that role,
 * OR if the user is a global superadmin (superadmin on any role).
 */
async function isGroupAdmin(userId, role) {
    const pool = (0, db_1.getPool)();
    const { rows } = await pool.query(sql_1.IS_GROUP_ADMIN, [userId, role]);
    return rows.length > 0;
}
/**
 * Can the actor manage members of the given role?
 * Superadmins can manage any role. Admins can manage roles they belong to.
 */
async function canManageRole(actorId, role) {
    return isGroupAdmin(actorId, role);
}
