// engine/rbac/roles.ts — Role definitions and permission sets (SPEC-166, SPEC-215)
//
// Roles and permissions are now loaded from src/config/rbac-roles.json via
// ConfigLoader, making them extensible per organization without code changes.
// The public API is backward-compatible: ROLE_PERMISSIONS, ROLE_DESCRIPTIONS,
// roleHasPermission, and listRoles all work exactly as before.
import { z } from 'zod';
import { ConfigLoader } from '../config-loader.js';
// ---------------------------------------------------------------------------
// Config schema
// ---------------------------------------------------------------------------
const PermissionActionSchema = z.enum([
    'create',
    'read',
    'update',
    'delete',
    'approve',
    'implement',
    'configure',
]);
const RbacRoleConfigSchema = z.object({
    id: z.string(),
    description: z.string(),
    permissions: z.array(PermissionActionSchema),
});
const RbacRoleConfigArraySchema = z.array(RbacRoleConfigSchema);
// ---------------------------------------------------------------------------
// Config loading (module-level, synchronous)
// ---------------------------------------------------------------------------
const loader = new ConfigLoader('rbac-roles', RbacRoleConfigArraySchema);
/**
 * Load all role definitions for an optional project, defaulting to system roles.
 * Returns a map from role id to its config entry.
 */
export function loadRoleConfigs(projectHash) {
    const items = loader.load(projectHash);
    return new Map(items.map((item) => [item.id, item]));
}
// System-level defaults — used for ROLE_PERMISSIONS and ROLE_DESCRIPTIONS constants.
const _systemRoles = loader.load();
// ---------------------------------------------------------------------------
// Role permission matrix (backward-compatible)
// ---------------------------------------------------------------------------
/**
 * Permissions granted to each role (system defaults).
 * All roles implicitly support 'read' — it is always included.
 *
 * For runtime extensibility (custom roles added via org/project config),
 * use loadRoleConfigs(projectHash) instead.
 */
export const ROLE_PERMISSIONS = Object.freeze(Object.fromEntries(_systemRoles.map((r) => [r.id, new Set(r.permissions)])));
// ---------------------------------------------------------------------------
// Role descriptions (backward-compatible)
// ---------------------------------------------------------------------------
export const ROLE_DESCRIPTIONS = Object.freeze(Object.fromEntries(_systemRoles.map((r) => [r.id, r.description])));
// ---------------------------------------------------------------------------
// Helpers
// ---------------------------------------------------------------------------
/** Returns true if the given role has the requested permission on any resource. */
export function roleHasPermission(role, action) {
    const permissions = ROLE_PERMISSIONS[role];
    return permissions?.has(action) ?? false;
}
/** Returns all roles defined in the system (or project if projectHash provided). */
export function listRoles(projectHash) {
    if (projectHash) {
        return [...loadRoleConfigs(projectHash).keys()];
    }
    return _systemRoles.map((r) => r.id);
}
//# sourceMappingURL=roles.js.map