/**
 * Role-based access control middleware
 *
 * Usage: requireRole(['super_admin', 'admin'])
 */

const ROLES = {
    SUPER_ADMIN: 'super_admin',
    ADMIN: 'admin',
    BEARBEITER: 'bearbeiter',
    BENUTZER: 'benutzer',
    SUPPORT: 'support',
    HR_PERSONAL: 'hr_personal',
    BUCHHALTUNG: 'buchhaltung',
    TECHNIKER: 'produktion',
};

/**
 * Middleware to check if user has one of the required roles
 * @param {Array<string>} allowedRoles - Array of role names that are allowed
 */
function requireRole(allowedRoles) {
    return (req, res, next) => {
        if (!req.user) {
            return res.status(401).json({
                status: 'error',
                message: 'Authentication required'
            });
        }

        if (!allowedRoles.includes(req.user.role)) {
            return res.status(403).json({
                status: 'error',
                message: 'Insufficient permissions'
            });
        }

        next();
    };
}

/**
 * Check if user is Super Admin
 */
function requireSuperAdmin(req, res, next) {
    return requireRole([ROLES.SUPER_ADMIN])(req, res, next);
}

/**
 * Check if user is Super Admin or Admin
 */
function requireAdmin(req, res, next) {
    return requireRole([ROLES.SUPER_ADMIN, ROLES.ADMIN])(req, res, next);
}

/**
 * Check if user can modify FIDO keys (Super Admin, Admin, or Bearbeiter)
 */
function canModifyFidoKeys(req, res, next) {
    return requireRole([ROLES.SUPER_ADMIN, ROLES.ADMIN, ROLES.BEARBEITER])(req, res, next);
}

/**
 * Check if user can view FIDO keys (all authenticated users)
 */
function canViewFidoKeys(req, res, next) {
    return requireRole([ROLES.SUPER_ADMIN, ROLES.ADMIN, ROLES.BEARBEITER, ROLES.BENUTZER, ROLES.HR_PERSONAL, ROLES.SUPPORT])(req, res, next);
}

/**
 * Check if user can view assets (Super Admin, Admin, Bearbeiter)
 */
function canViewAssets(req, res, next) {
    return requireRole([ROLES.SUPER_ADMIN, ROLES.ADMIN, ROLES.TECHNIKER, ROLES.HR_PERSONAL, ROLES.SUPPORT, ROLES.BEARBEITER])(req, res, next);
}

/**
 * Check if user can modify assets (Super Admin, Admin only)
 */
function canModifyAssets(req, res, next) {
    return requireRole([ROLES.SUPER_ADMIN, ROLES.ADMIN, ROLES.TECHNIKER])(req, res, next);
}

/**
 * Check if user can view tickets (all authenticated users)
 */
function canViewTickets(req, res, next) {
    return requireRole([ROLES.SUPER_ADMIN, ROLES.ADMIN, ROLES.SUPPORT, ROLES.BEARBEITER, ROLES.BENUTZER, ROLES.HR_PERSONAL, ROLES.BUCHHALTUNG, ROLES.TECHNIKER])(req, res, next);
}

/**
 * Check if user can modify tickets (Super Admin, Admin, Support)
 */
function canModifyTickets(req, res, next) {
    return requireRole([ROLES.SUPER_ADMIN, ROLES.ADMIN, ROLES.SUPPORT])(req, res, next);
}

/**
 * Can view onboarding: admins + dept roles (hr_personal, buchhaltung, support used for IT)
 */
function canViewOnboarding(req, res, next) {
    return requireRole([
        ROLES.SUPER_ADMIN, ROLES.ADMIN,
        ROLES.HR_PERSONAL, ROLES.BUCHHALTUNG, ROLES.SUPPORT,
    ])(req, res, next);
}

// Departments visible per role
const TECHNIKER_DEPARTMENTS = ['Produktion', 'Techniker'];

module.exports = {
    ROLES,
    TECHNIKER_DEPARTMENTS,
    requireRole,
    requireSuperAdmin,
    requireAdmin,
    canModifyFidoKeys,
    canViewFidoKeys,
    canViewAssets,
    canModifyAssets,
    canViewTickets,
    canModifyTickets,
    canViewOnboarding,
};
