export const adminLevelNames = { super: '超级管理员', school: '校级管理员', class: '班级管理员' };

export const permissionsByLevel = {
  super: ['*'],
  school: ['dashboard.read', 'candidates.read', 'candidates.write', 'candidates.review', 'registrations.read', 'registrations.review', 'payments.read', 'payments.write', 'results.read', 'centers.read', 'centers.write', 'workflows.inbox'],
  class: ['dashboard.read', 'candidates.read', 'candidates.review', 'registrations.read', 'registrations.review', 'payments.read', 'payments.write', 'results.read', 'workflows.inbox']
};

export function hasPermission(user, permission) {
  if (user?.role !== 'admin') return false;
  const permissions = permissionsByLevel[user.adminLevel || 'super'] || [];
  return permissions.includes('*') || permissions.includes(permission);
}

export function createPermissionGuard(sendError) {
  return function requirePermission(user, response, permission) {
    if (hasPermission(user, permission)) return true;
    sendError(response, 403, '当前管理员层级无权执行此操作');
    return false;
  };
}

export function profileInScope(user, profile) {
  if (user.adminLevel === 'super') return true;
  if (user.adminLevel === 'school') return Boolean(user.schoolId && profile.schoolId === user.schoolId);
  return Boolean(user.classId && profile.classId === user.classId);
}

export function registrationInScope(db, user, registration) {
  const profile = db.candidateProfiles.find(item => item.userId === registration.userId);
  return Boolean(profile && profileInScope(user, profile));
}

export function adminScopeLabel(db, user) {
  if (user.adminLevel === 'super') return '全部学校与班级';
  const school = db.schools.find(item => item.id === user.schoolId)?.name || '未绑定学校';
  if (user.adminLevel === 'school') return school;
  const schoolClass = db.classes.find(item => item.id === user.classId)?.name || '未绑定班级';
  return `${school} · ${schoolClass}`;
}