// src/server/entities/role-permissions.ts
import { bigint, index as index3, unique } from "drizzle-orm/pg-core";
import { id as id3, timestamps as timestamps3 } from "@spfn/core/db";

// src/server/entities/roles.ts
import { text, boolean, integer, index } from "drizzle-orm/pg-core";
import { id, timestamps } from "@spfn/core/db";

// src/server/entities/schema.ts
import { createFunctionSchema } from "@spfn/core/db";
var authSchema = createFunctionSchema("@spfn/auth");

// src/server/entities/roles.ts
var roles = authSchema.table(
  "roles",
  {
    // Primary key
    id: id(),
    // Role identifier (used in code, e.g., 'admin', 'editor')
    // Must be unique, lowercase, kebab-case recommended
    name: text("name").notNull().unique(),
    // Display name for UI (e.g., 'Administrator', 'Content Editor')
    displayName: text("display_name").notNull(),
    // Role description
    description: text("description"),
    // Built-in role flag
    // true: Core package roles (user, admin, superadmin) - cannot be deleted
    // false: Custom or preset roles - can be deleted
    isBuiltin: boolean("is_builtin").notNull().default(false),
    // System role flag
    // true: Defined in code (builtin or preset) - deletion restricted
    // false: Runtime created custom role - fully manageable
    isSystem: boolean("is_system").notNull().default(false),
    // Active status
    // false: Deactivated role (users cannot be assigned)
    isActive: boolean("is_active").notNull().default(true),
    // Priority level (higher = more privileged)
    // superadmin: 100, admin: 80, user: 10
    // Used for role hierarchy and conflict resolution
    priority: integer("priority").notNull().default(10),
    ...timestamps()
  },
  (table) => [
    index("roles_name_idx").on(table.name),
    index("roles_is_system_idx").on(table.isSystem),
    index("roles_is_active_idx").on(table.isActive),
    index("roles_is_builtin_idx").on(table.isBuiltin),
    index("roles_priority_idx").on(table.priority)
  ]
);

// src/server/entities/permissions.ts
import { text as text2, boolean as boolean2, index as index2 } from "drizzle-orm/pg-core";
import { id as id2, timestamps as timestamps2 } from "@spfn/core/db";
var permissions = authSchema.table(
  "permissions",
  {
    // Primary key
    id: id2(),
    // Permission identifier (e.g., 'user:delete', 'post:publish')
    // Format: resource:action or namespace:resource:action
    // Must be unique
    name: text2("name").notNull().unique(),
    // Display name for UI
    displayName: text2("display_name").notNull(),
    // Permission description
    description: text2("description"),
    // Category for grouping (e.g., 'user', 'post', 'admin', 'system')
    category: text2("category"),
    // Built-in permission flag
    // true: Core package permissions - cannot be deleted
    // false: Custom or preset permissions
    isBuiltin: boolean2("is_builtin").notNull().default(false),
    // System permission flag
    // true: Defined in code (builtin or preset)
    // false: Runtime created custom permission
    isSystem: boolean2("is_system").notNull().default(false),
    // Active status
    // false: Deactivated permission (not enforced)
    isActive: boolean2("is_active").notNull().default(true),
    ...timestamps2()
  },
  (table) => [
    index2("permissions_name_idx").on(table.name),
    index2("permissions_category_idx").on(table.category),
    index2("permissions_is_system_idx").on(table.isSystem),
    index2("permissions_is_active_idx").on(table.isActive),
    index2("permissions_is_builtin_idx").on(table.isBuiltin)
  ]
);

// src/server/entities/role-permissions.ts
var rolePermissions = authSchema.table(
  "role_permissions",
  {
    // Primary key
    id: id3(),
    // Foreign key to roles table
    roleId: bigint("role_id", { mode: "number" }).notNull().references(() => roles.id, { onDelete: "cascade" }),
    // Foreign key to permissions table
    permissionId: bigint("permission_id", { mode: "number" }).notNull().references(() => permissions.id, { onDelete: "cascade" }),
    ...timestamps3()
  },
  (table) => [
    // Indexes for query performance
    index3("role_permissions_role_id_idx").on(table.roleId),
    index3("role_permissions_permission_id_idx").on(table.permissionId),
    // Unique constraint: one role-permission pair only
    unique("role_permissions_unique").on(table.roleId, table.permissionId)
  ]
);
export {
  rolePermissions
};
//# sourceMappingURL=role-permissions.js.map