import type { PrismaClient } from '../../src/generated/prisma/client';

// Auth guard roles/permissions apply to (matches CaslAbilityFactory default).
export const GUARD = 'web';

// Default roles, seeded on every run. Add new roles here as the system grows.
const DEFAULT_ROLES = [
  'admin',
  'private_sector',
  'ministry',
  'cdc',
  'cefp',
  'cdc_g-psf',
];

// The role that receives the "manage all" wildcard (full access via CASL).
export const SUPER_ADMIN_ROLE = 'admin';

export type SeedRoleMap = Map<string, { id: number }>;

export async function seedRoles(prisma: PrismaClient) {
  const rolesByName: SeedRoleMap = new Map();

  for (const name of DEFAULT_ROLES) {
    let role = await prisma.roles.findFirst({
      where: { name, guardName: GUARD, deletedAt: null },
      select: { id: true },
    });

    if (!role) {
      role = await prisma.roles.create({
        data: { name, guardName: GUARD },
        select: { id: true },
      });
    }

    rolesByName.set(name, role);
  }

  return {
    roleNames: DEFAULT_ROLES,
    rolesByName,
  };
}