<?php
/**
 * Authorization / permissions helpers.
 *
 * Permissions are simple strings (e.g. "attendance.view").
 * Roles: admin, clerk, finance, voting, group_manager, data_collector, reg_coordinator, system_admin
 */

function permissionsMap(): array {
    return [
        'admin' => [
            // Admin can do everything in church app.
            '*',
        ],
        'data_collector' => [
            // Field team: /mobile app (enforced in index.php + mobile routes) + households on web.
            'mobile.collect',
            'households.manage',
        ],
        'reg_coordinator' => [
            // Oversight: read-only registration / collection metrics (no member or household edits).
            'registration.progress',
        ],
        'clerk' => [
            // Data entry / records
            'members.view',
            'members.edit',
            'households.manage',
            'attendance.view',
            'attendance.record',
        ],
        'finance' => [
            'members.view',
            'finance.view',
            'finance.record',
            'finance.reports',
            'finance.manage',
        ],
        'voting' => [
            'members.view',
            'voting.view',
            'voting.manage',
        ],
        'group_manager' => [
            'members.view',
            'fellowships.manage',
        ],
        'system_admin' => [
            'system.view',
            'system.manage',
        ],
    ];
}

function roleHasPermission(string $role, string $permission): bool {
    $map = permissionsMap();
    $perms = $map[$role] ?? [];
    if (in_array('*', $perms, true)) return true;
    return in_array($permission, $perms, true);
}

function can(string $permission): bool {
    if (!function_exists('currentUserRole')) {
        return false;
    }
    $role = (string) currentUserRole();
    return roleHasPermission($role, $permission);
}

/**
 * Require a permission or redirect to a sensible default.
 */
function requirePermission(string $permission): void {
    if (can($permission)) return;

    // Redirect to the user's default area (mirrors requireAdmin() behavior)
    if (function_exists('currentUserRole')) {
        $role = (string) currentUserRole();
        if ($role === 'system_admin') { header('Location: ' . BASE_PATH . '/system'); exit; }
        if ($role === 'group_manager') { header('Location: ' . BASE_PATH . '/fellowships'); exit; }
        if ($role === 'finance') { header('Location: ' . BASE_PATH . '/finance'); exit; }
        if ($role === 'voting') { header('Location: ' . BASE_PATH . '/voting'); exit; }
        if ($role === 'clerk') { header('Location: ' . BASE_PATH . '/members'); exit; }
        if ($role === 'data_collector') {
            require_once __DIR__ . '/collect-routing.php';
            nazareth_redirect(nazareth_data_collector_home_route());
        }
        if ($role === 'reg_coordinator') { header('Location: ' . BASE_PATH . '/registration-progress'); exit; }
    }

    header('Location: ' . BASE_PATH . '/members');
    exit;
}

