"""
RBAC Permissions Registry
==========================
This file is the **single source of truth** for every permission in the system.

Structure:
  RESOURCE.ACTION      e.g.  applications.view, applications.edit

PII permissions are prefixed with `pii.`
  pii.RESOURCE.FIELD   e.g.  pii.applicant.phone, pii.applicant.aadhaar

Each permission is a plain string constant.
To add a new permission, just add a new constant here. 
It will automatically become available to be assigned to any role in roles_config.yaml.
"""
from dataclasses import dataclass, field
from typing import Set


# ---------------------------------------------------------------------------
# Permission string constants
# ---------------------------------------------------------------------------

class Perm:
    """All available permission strings in the system."""

    # ── Applications ────────────────────────────────────────────────────────
    APPLICATIONS_VIEW           = "applications.view"
    APPLICATIONS_CREATE         = "applications.create"
    APPLICATIONS_EDIT           = "applications.edit"
    APPLICATIONS_DELETE         = "applications.delete"
    APPLICATIONS_EXPORT         = "applications.export"

    # ── Disbursements ────────────────────────────────────────────────────────
    DISBURSEMENTS_VIEW          = "disbursements.view"
    DISBURSEMENTS_APPROVE       = "disbursements.approve"
    DISBURSEMENTS_REJECT        = "disbursements.reject"

    # ── Users & Agents ───────────────────────────────────────────────────────
    USERS_VIEW                  = "users.view"
    USERS_CREATE                = "users.create"
    USERS_EDIT                  = "users.edit"
    USERS_DELETE                = "users.delete"

    # ── Merchants ────────────────────────────────────────────────────────────
    MERCHANTS_VIEW              = "merchants.view"
    MERCHANTS_CREATE            = "merchants.create"
    MERCHANTS_EDIT              = "merchants.edit"
    MERCHANTS_DELETE            = "merchants.delete"

    # ── Products & Offers ────────────────────────────────────────────────────
    PRODUCTS_VIEW               = "products.view"
    PRODUCTS_MANAGE             = "products.manage"

    # ── Analytics / Reports ──────────────────────────────────────────────────
    ANALYTICS_VIEW              = "analytics.view"
    REPORTS_EXPORT              = "reports.export"

    # ── RBAC Management ──────────────────────────────────────────────────────
    ROLES_VIEW                  = "roles.view"
    ROLES_CREATE                = "roles.create"
    ROLES_EDIT                  = "roles.edit"
    ROLES_DELETE                = "roles.delete"

    # ── PII Fields ───────────────────────────────────────────────────────────
    # Viewing these fields is controlled independently from the record itself.
    PII_PHONE                   = "pii.applicant.phone"
    PII_EMAIL                   = "pii.applicant.email"
    PII_AADHAAR                 = "pii.applicant.aadhaar"
    PII_PAN                     = "pii.applicant.pan"
    PII_DOB                     = "pii.applicant.dob"
    PII_BANK_ACCOUNT            = "pii.applicant.bank_account"
    PII_ADDRESS                 = "pii.applicant.address"


# ---------------------------------------------------------------------------
# Human-readable metadata for each permission (used in admin UI)
# ---------------------------------------------------------------------------

@dataclass
class PermissionMeta:
    key: str
    label: str
    group: str
    description: str = ""
    is_pii: bool = False


PERMISSION_CATALOG: list[PermissionMeta] = [
    # Applications
    PermissionMeta(Perm.APPLICATIONS_VIEW,      "View Applications",        "Applications"),
    PermissionMeta(Perm.APPLICATIONS_CREATE,    "Create Applications",      "Applications"),
    PermissionMeta(Perm.APPLICATIONS_EDIT,      "Edit Applications",        "Applications"),
    PermissionMeta(Perm.APPLICATIONS_DELETE,    "Delete Applications",      "Applications"),
    PermissionMeta(Perm.APPLICATIONS_EXPORT,    "Export Applications",      "Applications"),

    # Disbursements
    PermissionMeta(Perm.DISBURSEMENTS_VIEW,     "View Disbursements",       "Disbursements"),
    PermissionMeta(Perm.DISBURSEMENTS_APPROVE,  "Approve Disbursements",    "Disbursements"),
    PermissionMeta(Perm.DISBURSEMENTS_REJECT,   "Reject Disbursements",     "Disbursements"),

    # Users
    PermissionMeta(Perm.USERS_VIEW,             "View Users",               "Users"),
    PermissionMeta(Perm.USERS_CREATE,           "Create Users",             "Users"),
    PermissionMeta(Perm.USERS_EDIT,             "Edit Users",               "Users"),
    PermissionMeta(Perm.USERS_DELETE,           "Delete Users",             "Users"),

    # Merchants
    PermissionMeta(Perm.MERCHANTS_VIEW,         "View Merchants",           "Merchants"),
    PermissionMeta(Perm.MERCHANTS_CREATE,       "Create Merchants",         "Merchants"),
    PermissionMeta(Perm.MERCHANTS_EDIT,         "Edit Merchants",           "Merchants"),
    PermissionMeta(Perm.MERCHANTS_DELETE,       "Delete Merchants",         "Merchants"),

    # Products & Offers
    PermissionMeta(Perm.PRODUCTS_VIEW,          "View Products & Offers",   "Products"),
    PermissionMeta(Perm.PRODUCTS_MANAGE,        "Manage Products & Offers", "Products"),

    # Analytics
    PermissionMeta(Perm.ANALYTICS_VIEW,         "View Analytics",           "Analytics"),
    PermissionMeta(Perm.REPORTS_EXPORT,         "Export Reports",           "Analytics"),

    # RBAC
    PermissionMeta(Perm.ROLES_VIEW,             "View Roles",               "RBAC"),
    PermissionMeta(Perm.ROLES_CREATE,           "Create Roles",             "RBAC"),
    PermissionMeta(Perm.ROLES_EDIT,             "Edit Roles",               "RBAC"),
    PermissionMeta(Perm.ROLES_DELETE,           "Delete Roles",             "RBAC"),

    # PII
    PermissionMeta(Perm.PII_PHONE,        "View Applicant Phone",       "PII", is_pii=True),
    PermissionMeta(Perm.PII_EMAIL,        "View Applicant Email",       "PII", is_pii=True),
    PermissionMeta(Perm.PII_AADHAAR,      "View Aadhaar Number",        "PII", is_pii=True),
    PermissionMeta(Perm.PII_PAN,          "View PAN Number",            "PII", is_pii=True),
    PermissionMeta(Perm.PII_DOB,          "View Date of Birth",         "PII", is_pii=True),
    PermissionMeta(Perm.PII_BANK_ACCOUNT, "View Bank Account Details",  "PII", is_pii=True),
    PermissionMeta(Perm.PII_ADDRESS,      "View Applicant Address",     "PII", is_pii=True),
]

# Quick lookup set of all valid permission strings for validation
ALL_PERMISSIONS: Set[str] = {p.key for p in PERMISSION_CATALOG}