# ============================================================
# roles_config.yaml
# ============================================================
# This is the TEMPORARY file-based role-to-permission mapping.
# It will be replaced by a DB-driven config later.
#
# How to use:
#   - Add a new role under `roles:`
#   - Assign any permissions from permissions_registry.py
#   - Restart uvicorn — changes take effect immediately
#
# Permission strings come from src/core/rbac/permissions_registry.py
# ============================================================

roles:

  super_admin:
    description: "Full access to everything including PII and RBAC management"
    permissions:
      - applications.view
      - applications.create
      - applications.edit
      - applications.delete
      - applications.export
      - disbursements.view
      - disbursements.approve
      - disbursements.reject
      - users.view
      - users.create
      - users.edit
      - users.delete
      - merchants.view
      - merchants.create
      - merchants.edit
      - merchants.delete
      - products.view
      - products.manage
      - analytics.view
      - reports.export
      - roles.view
      - roles.create
      - roles.edit
      - roles.delete
      - pii.applicant.phone
      - pii.applicant.email
      - pii.applicant.aadhaar
      - pii.applicant.pan
      - pii.applicant.dob
      - pii.applicant.bank_account
      - pii.applicant.address

  credit_ops:
    description: "Credit operations team — can view and edit applications, no PII aadhar/PAN"
    permissions:
      - applications.view
      - applications.create
      - applications.edit
      - applications.export
      - disbursements.view
      - merchants.view
      - products.view
      - products.manage
      - analytics.view
      - pii.applicant.phone
      - pii.applicant.email
      - pii.applicant.dob
      - pii.applicant.address

  field_agent:
    description: "On-ground agents — can create and view applications only"
    permissions:
      - applications.view
      - applications.create
      - merchants.view
      - products.view

  finance:
    description: "Finance team — can approve/reject disbursements and view reports"
    permissions:
      - applications.view
      - disbursements.view
      - disbursements.approve
      - disbursements.reject
      - analytics.view
      - reports.export
      - pii.applicant.bank_account

  merchant_user:
    description: "Merchant partner — can only create and view their own applications"
    permissions:
      - applications.view
      - applications.create

  read_only:
    description: "View-only access with no PII"
    permissions:
      - applications.view
      - disbursements.view
      - merchants.view
      - analytics.view