namespace ZB.MOM.WW.OtOpcUa.Security.Auth;

/// <summary>
///     Names of the AdminUI authorization policies registered by <c>AddOtOpcUaAuth</c>.
///     Single source of truth — pages, AuthorizeView blocks, imperative checks, and endpoint
///     groups must reference these constants, never string literals (guarded by
///     PageAuthorizationGuardTests). Policy → role mapping lives in ServiceCollectionExtensions.
/// </summary>
public static class AdminUiPolicies
{
    /// <summary>Fleet-wide admin actions (RoleGrants page, certificate mutations). Roles: Administrator.</summary>
    public const string FleetAdmin = "FleetAdmin";

    /// <summary>Live driver operations (reconnect/restart, alarm ack/shelve, live address browse). Roles: Operator, Administrator.</summary>
    public const string DriverOperator = "DriverOperator";

    /// <summary>Config authoring: UNS/equipment/cluster/driver/ACL/namespace/script editors + deploy + script analysis. Roles: Administrator, Designer.</summary>
    public const string ConfigEditor = "ConfigEditor";

    /// <summary>Read-only AdminUI access (dashboards, lists, live tails). Any authenticated user.</summary>
    public const string AuthenticatedRead = "AuthenticatedRead";
}
