/* SkyOps — Role-based access control. One matrix, one check: skyCan(action).
   Buttons opt in with data-perm="action"; global events (new inspection / WO / certificate) are gated too. */

const RB_ROLES = ["Admin", "Manager", "Analyst", "Operator", "Viewer"];
const RB_ROLE_D = { Admin: "Everything, including users, tenant settings and billing", Manager: "Sites, assets, crew, work orders and commercial", Analyst: "Review detections, sign off and deliver reports, warranty claims", Operator: "Fly missions, capture, review detections, work orders", Viewer: "Read-only · can export reports and data" };
const RB_ACTIONS = [
  ["inspection.create", "Plan / create inspections", "Operations"],
  ["detection.review", "Accept, reject, reclassify detections", "Operations"],
  ["wo.create", "Create & update work orders", "Operations"],
  ["report.approve", "Sign off & deliver reports", "Intelligence"],
  ["warranty.submit", "Create & submit warranty claims", "Intelligence"],
  ["asset.manage", "Create / edit sites, drones and asset registry", "Assets"],
  ["crew.manage", "Manage crew & certifications", "Assets"],
  ["commercial.edit", "Quotes, invoicing, price book", "Business"],
  ["settings.tenant", "Tenant settings, thresholds, integrations", "System"],
  ["users.manage", "Invite users, change roles", "System"],
  ["data.export", "Export data & reports", "System"],
];
const RB_MATRIX = {
  Admin: RB_ACTIONS.map(a => a[0]),
  Manager: ["inspection.create", "detection.review", "wo.create", "warranty.submit", "asset.manage", "crew.manage", "commercial.edit", "data.export"],
  Analyst: ["detection.review", "wo.create", "report.approve", "warranty.submit", "data.export"],
  Operator: ["inspection.create", "detection.review", "wo.create"],
  Viewer: ["data.export"],
};
const RB_PERSONA = { pilot: "Operator", analyst: "Analyst", site_manager: "Admin", service_mgr: "Manager", portfolio: "Viewer" };
const skyRole = () => RB_PERSONA[document.documentElement.dataset.persona] || "Admin";
const skyCan = (a) => (RB_MATRIX[skyRole()] || []).includes(a);
const rbWho = (a) => RB_ROLES.filter(r => RB_MATRIX[r].includes(a)).join(", ");
const rbDeny = (a) => window.skyToast && window.skyToast(`Not allowed for ${skyRole()} · requires ${rbWho(a)}`);

(function rbInit() {
  if (window.__rbInit) return; window.__rbInit = true;
  const apply = () => document.querySelectorAll("[data-perm]").forEach(el => {
    const ok = skyCan(el.dataset.perm);
    el.classList.toggle("rb-locked", !ok);
    if (!ok) { if (!el.dataset.rbTitle) el.dataset.rbTitle = el.title || ""; el.title = `Requires ${rbWho(el.dataset.perm)}`; el.setAttribute("aria-disabled", "true"); }
    else if (el.dataset.rbTitle !== undefined) { el.title = el.dataset.rbTitle; delete el.dataset.rbTitle; el.removeAttribute("aria-disabled"); }
  });
  let t = null; new MutationObserver(() => { clearTimeout(t); t = setTimeout(apply, 30); }).observe(document.body, { childList: true, subtree: true });
  window.addEventListener("skyops:appearance-changed", () => setTimeout(apply, 0));
  document.addEventListener("click", (e) => { const el = e.target.closest && e.target.closest("[data-perm]"); if (el && !skyCan(el.dataset.perm)) { e.preventDefault(); e.stopImmediatePropagation(); rbDeny(el.dataset.perm); } }, true);
  const gate = (ev, a) => window.addEventListener(ev, (e) => { if (!skyCan(a)) { e.stopImmediatePropagation(); rbDeny(a); } }, true);
  gate("skyops:new-insp", "inspection.create"); gate("skyops:new-wo", "wo.create"); gate("skyops:cert-modal", "crew.manage");
  setTimeout(apply, 0);
})();

Object.assign(window, { RB_ROLES, RB_ROLE_D, RB_ACTIONS, RB_MATRIX, skyRole, skyCan, rbWho, rbDeny });