namespace TarninaHub.Application.Security;

public static class RoleNames
{
    public const string User = "user";
    public const string Jst = "jst";
    public const string Operator = "operator";
    public const string Manager = "manager";
    public const string Admin = "admin";

    public static readonly IReadOnlyList<string> All =
        [User, Jst, Operator, Manager, Admin];

    public static bool IsValid(string role) => All.Contains(role);
}

public static class Policies
{
    /// <summary>operator, manager, admin — ROPS/expert staff.</summary>
    public const string Staff = "Staff";

    /// <summary>operator, admin.</summary>
    public const string OperatorOrAdmin = "OperatorOrAdmin";

    /// <summary>manager, operator, admin.</summary>
    public const string ManagerOrAbove = "ManagerOrAbove";

    /// <summary>admin only.</summary>
    public const string AdminOnly = "AdminOnly";

    /// <summary>jst and above (jst, operator, manager, admin).</summary>
    public const string JstOrAbove = "JstOrAbove";
}

public static class ConsentScopes
{
    /// <summary>Access granted by the data subject's consent.</summary>
    public const string ByConsent = "by-consent";

    /// <summary>Time-limited access (uses consent.expires_at).</summary>
    public const string Temporary = "temporary";

    /// <summary>Fully anonymized data (no personal identifiers).</summary>
    public const string Anonymized = "anonymized";

    public static readonly IReadOnlyList<string> All = [ByConsent, Temporary, Anonymized];
}