/* teach - centrale permissiematrix voor de vaste rollen, inclusief ouder.
   Gespiegeld in src/permissions.js (geen bundler in dit project, dus twee bestanden
   die dezelfde waarden hand-in-hand bijhouden). */
const PERMISSIONS = {
  'admin.access':           ['super', 'admin', 'teacher'],
  'curriculum.view':        ['super', 'admin', 'teacher', 'parent'],
  'password.own.change':    ['super', 'admin', 'teacher'],
  'schools.manage':         ['super'],
  'schools.resetPasswords': ['super', 'admin'],
  'classes.view':           ['super', 'admin', 'teacher'],
  'classes.manage':         ['super', 'admin'],
  'users.manage':           ['super', 'admin', 'teacher'],
  'users.staffCredentials': ['super', 'admin'],
  'users.genpw':            ['super', 'admin', 'teacher'],
  'users.role.change':      ['super'],
  'assignments.manage':     ['super', 'admin', 'teacher'],
  'progress.view':          ['super', 'admin', 'teacher'],
  'shared.global.manage':   ['super'],
  'content.manage':         ['super'],
  'shared.school.manage':   ['super', 'admin', 'teacher'],
};

const CREATABLE_ROLES = {
  super: ['super', 'admin', 'teacher', 'pupil'],
  admin: ['admin', 'teacher', 'pupil'],
  teacher: ['pupil'],
};

/* Een systeemmanager kan uitsluitend de clientweergave van een andere rol
   simuleren. Het HttpOnly-account en alle serverautorisatie blijven ongewijzigd. */
const VIEW_ROLES = ["super","admin","teacher","parent","pupil"];
let VIEW_AS_ROLE = "super";
function setActiveViewRole(role){
  VIEW_AS_ROLE = VIEW_ROLES.includes(role) ? role : "super";
}
function activeRole(){
  if(!currentUser) return null;
  return currentUser.role==="super" ? VIEW_AS_ROLE : currentUser.role;
}
function activeRoles(){
  if(!currentUser) return [];
  const role=activeRole();
  return role===currentUser.role ? [currentUser.role,...(currentUser.extraRoles||[])] : [role];
}
/* can(action) gebruikt het actieve weergaveprofiel. De server blijft iedere
   aanvraag vanzelf tegen het echte account autoriseren. */
function can(action){
  return (PERMISSIONS[action] || []).some(r => activeRoles().includes(r));
}