/**
 * The three Balinyaar actor experiences. Each maps to a route-group shell under
 * `(private-routes)` and its own navigation. The real role list arrives with the
 * server in f1-b2; until then `useActorRole()` defaults to CUSTOMER so the shells
 * render gracefully without a role on the session.
 */
export const APP_ROLES = {
  CUSTOMER: 'customer',
  NURSE: 'nurse',
  ADMIN: 'admin',
} as const;

export type AppRole = (typeof APP_ROLES)[keyof typeof APP_ROLES];

export const DEFAULT_ROLE: AppRole = APP_ROLES.CUSTOMER;

/**
 * The server's **fine-grained** admin sub-role codes (b2 `AdminRole` / b15 RBAC). The coarse
 * `AppRole` collapses all of these to the single ADMIN shell (`toAppRoles`), but the f15 backoffice
 * needs the fine grain to gate individual consoles (a `support` admin can't run a payout, a
 * `moderation` admin can't refund). Kept aligned with the auth contract enum — note it is
 * `moderation`, not `moderator`. Stored raw on the session (`SessionUser.roleCodes`) and read by
 * `useAdminCapabilities()`.
 */
export const ADMIN_ROLE_CODES = ['super_admin', 'admin', 'support', 'finance', 'moderation'] as const;

export type AdminRoleCode = (typeof ADMIN_ROLE_CODES)[number];

export function isAdminRoleCode(code: string): code is AdminRoleCode {
  return (ADMIN_ROLE_CODES as readonly string[]).includes(code);
}