"""
Staff Role Permission Keys

These keys control access to menu items and dangerous operations for staff members.
All permissions default to False for staff unless explicitly granted via their role
or user-level override.

Permission Resolution Order:
1. User-level override (user.permissions JSONField) - highest priority
2. Staff role permissions (user.staff_role.permissions)
3. Default: False
"""

# Menu/Page Access Permissions
# These control visibility of sidebar menu items and access to corresponding pages/APIs
MENU_PERMISSIONS = {
    'can_access_dashboard': {
        'label': 'Dashboard',
        'description': 'Access the main dashboard',
        'default': True,
    },
    'can_access_scheduler': {
        'label': 'Scheduler',
        'description': 'View and manage the appointment calendar',
        'default': False,
    },
    'can_access_tasks': {
        'label': 'Tasks',
        'description': 'View and manage scheduled tasks',
        'default': False,
    },
    'can_access_my_schedule': {
        'label': 'My Schedule',
        'description': 'View own appointments and schedule',
        'default': True,
    },
    'can_access_my_availability': {
        'label': 'My Availability',
        'description': 'Manage own availability and time off',
        'default': True,
    },
    'can_access_site_builder': {
        'label': 'Site Builder',
        'description': 'Edit the booking site',
        'default': False,
    },
    'can_access_gallery': {
        'label': 'Media Gallery',
        'description': 'Manage photos and media',
        'default': False,
    },
    'can_access_customers': {
        'label': 'Customers',
        'description': 'View and manage customer list',
        'default': False,
    },
    'can_access_services': {
        'label': 'Services',
        'description': 'View and manage services',
        'default': False,
    },
    'can_access_resources': {
        'label': 'Resources',
        'description': 'View and manage resources',
        'default': False,
    },
    'can_access_staff': {
        'label': 'Staff',
        'description': 'View and manage staff members',
        'default': False,
    },
    'can_access_contracts': {
        'label': 'Contracts',
        'description': 'View and manage contracts',
        'default': False,
    },
    'can_access_time_blocks': {
        'label': 'Time Blocks',
        'description': 'Manage business time blocks',
        'default': False,
    },
    'can_access_locations': {
        'label': 'Locations',
        'description': 'Manage business locations',
        'default': False,
    },
    'can_access_messages': {
        'label': 'Messages',
        'description': 'Send broadcast messages',
        'default': False,
    },
    'can_access_tickets': {
        'label': 'Tickets',
        'description': 'View and manage support tickets',
        'default': False,
    },
    'can_access_payments': {
        'label': 'Payments',
        'description': 'View payment information',
        'default': False,
    },
    'can_access_automations': {
        'label': 'Automations',
        'description': 'View and manage automations',
        'default': False,
    },
}

# Dangerous Operation Permissions
# These control specific destructive or sensitive operations at the API level
DANGEROUS_PERMISSIONS = {
    'can_delete_customers': {
        'label': 'Delete Customers',
        'description': 'Permanently delete customer records',
        'default': False,
    },
    'can_cancel_appointments': {
        'label': 'Cancel Appointments',
        'description': 'Cancel appointments',
        'default': False,
    },
    'can_delete_appointments': {
        'label': 'Delete Appointments',
        'description': 'Permanently delete appointments',
        'default': False,
    },
    'can_refund_payments': {
        'label': 'Process Refunds',
        'description': 'Issue refunds to customers',
        'default': False,
    },
    'can_delete_resources': {
        'label': 'Delete Resources',
        'description': 'Delete bookable resources',
        'default': False,
    },
    'can_delete_services': {
        'label': 'Delete Services',
        'description': 'Delete service offerings',
        'default': False,
    },
    'can_invite_staff': {
        'label': 'Invite Staff',
        'description': 'Send invitations to new staff members',
        'default': False,
    },
    'can_self_approve_time_off': {
        'label': 'Self-Approve Time Off',
        'description': 'Approve own time off requests without manager approval',
        'default': False,
    },
}

# All permissions combined for easy iteration
ALL_PERMISSIONS = {**MENU_PERMISSIONS, **DANGEROUS_PERMISSIONS}


def get_default_permissions_for_role(role_name: str) -> dict:
    """
    Get the default permissions for a built-in role.

    Args:
        role_name: One of 'Full Access Staff', 'Front Desk', 'Limited Staff'

    Returns:
        Dict of permission keys to boolean values
    """
    return DEFAULT_ROLES.get(role_name, {}).get('permissions', {})


# Default role configurations
# These are created for each tenant during migration and on new tenant creation
DEFAULT_ROLES = {
    'Full Access Staff': {
        'description': 'Complete access to all features (similar to manager)',
        'permissions': {k: True for k in ALL_PERMISSIONS.keys()},
    },
    'Front Desk': {
        'description': 'Access to scheduling, customers, and basic operations',
        'permissions': {
            'can_access_dashboard': True,
            'can_access_scheduler': True,
            'can_access_my_schedule': True,
            'can_access_my_availability': True,
            'can_access_customers': True,
            'can_access_tickets': True,
            'can_cancel_appointments': True,
        },
    },
    'Limited Staff': {
        'description': 'Basic access to own schedule only',
        'permissions': {
            'can_access_dashboard': True,
            'can_access_my_schedule': True,
            'can_access_my_availability': True,
        },
    },
}
