/**
 * 前端页面级权限矩阵：与后端 @Roles 约束保持一致，避免页面可见但接口被 403。
 */
const ADMIN_ROLES = Object.freeze(['SYSTEM_ADMIN', 'HOSPITAL_ADMIN']);
const ORG_MANAGER_ROLES = ADMIN_ROLES;
const USER_MANAGER_ROLES = Object.freeze([
  'SYSTEM_ADMIN',
  'HOSPITAL_ADMIN',
  'DIRECTOR',
  'LEADER',
]);
const TASK_ROLES = Object.freeze([
  'SYSTEM_ADMIN',
  'HOSPITAL_ADMIN',
  'DOCTOR',
  'DIRECTOR',
  'LEADER',
  'ENGINEER',
]);
const PATIENT_ROLES = Object.freeze([
  'SYSTEM_ADMIN',
  'HOSPITAL_ADMIN',
  'DIRECTOR',
  'LEADER',
  // 后端患者接口允许医生访问，页面侧也应放开，避免前端先把医生拦掉。
  'DOCTOR',
]);
const UPLOAD_ROLES = ADMIN_ROLES;

export const ROLE_PERMISSIONS = Object.freeze({
  ORG_TREE: ORG_MANAGER_ROLES,
  ORG_HOSPITALS: Object.freeze(['SYSTEM_ADMIN']),
  // 主任/组长仍可通过接口读取科室信息，但不再开放独立“科室管理”页面。
  ORG_DEPARTMENTS: ADMIN_ROLES,
  ORG_GROUPS: ADMIN_ROLES,
  DICTIONARIES: Object.freeze(['SYSTEM_ADMIN']),
  USERS: USER_MANAGER_ROLES,
  DEVICES: Object.freeze(['SYSTEM_ADMIN']),
  UPLOADS: UPLOAD_ROLES,
  TASKS: TASK_ROLES,
  PATIENTS: PATIENT_ROLES,
});

/**
 * 判断当前角色是否拥有页面访问权限。
 */
export function hasRolePermission(role, allowedRoles) {
  if (!Array.isArray(allowedRoles) || allowedRoles.length === 0) {
    return true;
  }
  return Boolean(role) && allowedRoles.includes(role);
}
