dyolink/frontend/src/shared/permissions.ts

import type { Organization } from '@/types/organization';

const ROUTE_TAB_READ: { prefix: string; permission: string }[] = [
  { prefix: '/today', permission: 'TAB_TODAY_READ' },
  { prefix: '/patients', permission: 'TAB_PATIENTS_READ' },
  { prefix: '/appointments', permission: 'TAB_APPOINTMENTS_READ' },
  { prefix: '/staff', permission: 'TAB_STAFF_READ' },
  { prefix: '/lab', permission: 'TAB_LAB_READ' },
  { prefix: '/billing', permission: 'TAB_BILLING_READ' },
  { prefix: '/reports', permission: 'TAB_REPORTS_READ' },
];

export function hasPermission(org: Organization | null, permission: string): boolean {
  if (!org) return false;
  return Boolean(org.permissions?.includes(permission));
}

/** Sidebar / route guard: READ access to a tab */
export function canViewTab(org: Organization | null, readPermission: string): boolean {
  return hasPermission(org, readPermission);
}

export function getRequiredReadPermissionForPath(pathname: string): string | null {
  for (const { prefix, permission } of ROUTE_TAB_READ) {
    if (pathname === prefix || pathname.startsWith(`${prefix}/`)) {
      return permission;
    }
  }
  return null;
}

/** First dashboard route the user may open (ordered). Fallback: account settings. */
export function firstAccessibleDashboardPath(org: Organization | null): string {
  if (!org) return '/today';
  for (const { prefix, permission } of ROUTE_TAB_READ) {
    if (hasPermission(org, permission)) return prefix;
  }
  return '/settings/account';
}

export function canEditStaff(org: Organization | null): boolean {
  return hasPermission(org, 'TAB_STAFF_EDIT');
}

export function canViewStaff(org: Organization | null): boolean {
  return (
    hasPermission(org, 'TAB_STAFF_READ') || hasPermission(org, 'TAB_STAFF_EDIT')
  );
}