/* teach - centrale permissiematrix voor de 4 vaste rollen (super/admin/teacher/pupil).
   Gespiegeld in src/permissions.js (geen bundler in dit project, dus twee bestanden
   die dezelfde waarden hand-in-hand bijhouden). */
const PERMISSIONS = {
  'admin.access':           ['super', 'admin', 'teacher'],
  'password.own.change':    ['super', 'admin', 'teacher'],
  'schools.manage':         ['super'],
  'schools.resetPasswords': ['super', 'admin'],
  'classes.view':           ['super', 'admin', 'teacher'],
  'classes.manage':         ['super', 'admin'],
  'users.manage':           ['super', 'admin', 'teacher'],
  'users.staffCredentials': ['super', 'admin'],
  'users.genpw':            ['super', 'admin', 'teacher'],
  'users.role.change':      ['super'],
  'assignments.manage':     ['super', 'admin', 'teacher'],
  'progress.view':          ['super', 'admin', 'teacher'],
  'shared.global.manage':   ['super'],
  'shared.school.manage':   ['super', 'admin', 'teacher'],
};

const CREATABLE_ROLES = {
  super: ['super', 'admin', 'teacher', 'pupil'],
  admin: ['admin', 'teacher', 'pupil'],
  teacher: ['pupil'],
};

/* can(action) gebruikt de ingelogde gebruiker (currentUser, uit core.js) - hoofdrol
   plus eventuele extra stafrollen (currentUser.extraRoles) */
function can(action){
  if(!currentUser) return false;
  const roles = [currentUser.role, ...(currentUser.extraRoles||[])];
  return (PERMISSIONS[action] || []).some(r => roles.includes(r));
}