// Permission Schema TypeScript Types
// Matches permission-schema.json structure

export type ParticipantType = 'DBIS' | 'SCB' | 'FI';

export type AccessLevel = 'tier_1' | 'tier_2' | 'tier_3' | 'tier_4';

export type Action =
  | 'view'
  | 'create'
  | 'update'
  | 'delete'
  | 'approve'
  | 'reject'
  | 'execute'
  | 'export'
  | 'audit'
  | 'escalate';

export type ScreenName =
  | 'dashboard'
  | 'operations'
  | 'governance'
  | 'compliance'
  | 'risk'
  | 'settlement'
  | 'cbdc'
  | 'treasury'
  | 'fx'
  | 'accounting'
  | 'quantum'
  | 'crisis'
  | 'reports'
  | 'admin';

export interface ScreenAccess {
  dashboard: boolean;
  operations: boolean;
  governance: boolean;
  compliance: boolean;
  risk: boolean;
  settlement: boolean;
  cbdc: boolean;
  treasury: boolean;
  fx: boolean;
  accounting: boolean;
  quantum: boolean;
  crisis: boolean;
  reports: boolean;
  admin: boolean;
}

export interface ActionPermissions {
  [module: string]: Action[];
}

export interface ApprovalRequirement {
  amountThreshold?: number;
  approverRole: string;
}

export interface RoleConstraints {
  separationOfDuties: string[];
  timeBased: {
    startTime?: string;
    endTime?: string;
    daysOfWeek?: number[];
  } | null;
  requiresApproval: boolean | ApprovalRequirement;
}

export interface RoleDefinition {
  participant: ParticipantType;
  accessLevel: AccessLevel;
  description: string;
  inheritsFrom: string[];
  screenAccess: ScreenAccess;
  actions: ActionPermissions;
  constraints: RoleConstraints;
}

export interface ScreenComponent {
  [componentName: string]: string;
}

export interface ScreenDefinition {
  name: string;
  description: string;
  components: ScreenComponent;
}

export interface EscalationLevel {
  role: string;
  timeout: number | null; // seconds, null means final level
}

export interface EscalationPath {
  levels: EscalationLevel[];
}

export interface PermissionSchema {
  $schema: string;
  title: string;
  version: string;
  description: string;
  participants: {
    [key in ParticipantType]: {
      name: string;
      roles: string[];
    };
  };
  roles: {
    [participant: string]: {
      [roleName: string]: RoleDefinition;
    };
  };
  screens: {
    [screenName: string]: ScreenDefinition;
  };
  actions: Action[];
  audit: {
    logAllPermissionChecks: boolean;
    logScreenAccess: boolean;
    logActionAttempts: boolean;
    retentionDays: number;
  };
  escalationPaths: {
    [pathName: string]: EscalationPath;
  };
}

export interface PermissionCheckResult {
  allowed: boolean;
  reason?: string;
  requiresApproval?: boolean;
  approverRole?: string;
  escalationPath?: EscalationPath;
}

export interface ScreenVisibilityResult {
  visible: boolean;
  components: {
    [componentName: string]: boolean;
  };
}

export interface AuditLogEntry {
  timestamp: Date;
  employeeId: string;
  role: string;
  participant: ParticipantType;
  checkType: 'permission' | 'screen' | 'action';
  resource: string;
  action?: Action;
  result: boolean;
  reason?: string;
  metadata?: Record<string, unknown>;
}

export interface ResourceContext {
  resourceType: string;
  resourceId?: string;
  amount?: number;
  currency?: string;
  metadata?: Record<string, unknown>;
}

