namespace ZB.MOM.WW.ScadaBridge.Security;

/// <summary>
/// Single source of truth for role-name string literals used across the
/// Security module and downstream authorization checks.
/// </summary>
/// <remarks>
/// <para>
/// Role names appear in three independent contexts: <see cref="RoleMapper"/>
/// (LDAP-group → role resolution), <see cref="AuthorizationPolicies"/>
/// (policy <c>RequireClaim</c> values + the audit role arrays), and at LDAP
/// mapping rows configured by an operator. Holding the literals here means a
/// rename either succeeds everywhere or fails to compile, eliminating the
/// "string drift" class.
/// </para>
/// <para>
/// Canonicalization (auth normalization): role VALUES were
/// standardized onto the canonical six (<c>Viewer/Operator/Engineer/Designer/
/// Deployer/Administrator</c>; only four are used by ScadaBridge). The legacy
/// ScadaBridge role names were renamed/collapsed as follows:
/// <list type="bullet">
///   <item><description><c>Admin</c> → <c>Administrator</c></description></item>
///   <item><description><c>Design</c> → <c>Designer</c></description></item>
///   <item><description><c>Deployment</c> → <c>Deployer</c></description></item>
///   <item><description><c>Audit</c> → <c>Administrator</c> (COLLAPSE — accepted
///   separation-of-duties loss; a former audit-only user gains the full admin
///   surface)</description></item>
///   <item><description><c>AuditReadOnly</c> → <c>Viewer</c> (COLLAPSE — keeps
///   audit-read + nav, loses bulk export, which it never had)</description></item>
/// </list>
/// <c>Engineer</c> exists in the canonical vocabulary but is unused by
/// ScadaBridge, so it is intentionally not declared here. <c>Operator</c> is
/// now declared for the two-person Secured Writes feature.
/// </para>
/// <para>
/// Secured Writes: <c>Operator</c> initiates a secured write and
/// <c>Verifier</c> approves it — two distinct global roles so a single principal
/// cannot both initiate and approve (separation of duties). Both are coarse
/// global roles, matching the existing role model; site scoping (if any) is
/// layered on at the LDAP-mapping level like the other roles.
/// </para>
/// </remarks>
public static class Roles
{
    public const string Administrator = "Administrator";
    public const string Designer = "Designer";
    public const string Deployer = "Deployer";
    public const string Viewer = "Viewer";

    /// <summary>Initiates a two-person Secured Write. Canonical
    /// vocabulary role; pairs with <see cref="Verifier"/> who approves.</summary>
    public const string Operator = "Operator";

    /// <summary>Approves a two-person Secured Write. Held by a
    /// principal distinct from the initiating <see cref="Operator"/>.</summary>
    public const string Verifier = "Verifier";

    /// <summary>All declared ScadaBridge roles — the single source of truth for "all
    /// permissions" (e.g. the dev auto-login principal). Stays in sync if a role is added.</summary>
    public static readonly string[] All = [Administrator, Designer, Deployer, Viewer, Operator, Verifier];
}