namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;

/// <summary>
///     Canonical string constants for the OPC UA <b>data-plane</b> roles the LDAP group→role map
///     produces and <see cref="RoleCarryingUserIdentity.Roles"/> carries onto the session identity.
///     These are distinct from the control-plane <c>AdminRole</c> enum (Admin UI capabilities) — the
///     two planes share zero runtime code path by design.
///     <para>
///         Across the codebase these data-plane roles (<c>ReadOnly</c>, <c>WriteOperate</c>,
///         <c>WriteTune</c>, <c>WriteConfigure</c>, <c>AlarmAck</c>, …) are used as bare strings
///         (they originate as LDAP group names mapped through <c>RoleMapper</c>). T18 introduced this
///         single shared const for the one role the inbound alarm-method gate reads, so the gate and
///         its tests reference one symbol instead of a re-typed literal. Comparison is case-insensitive
///         (the role set is built with <see cref="System.StringComparer.OrdinalIgnoreCase"/>), so the
///         gate matches with that comparer too.
///     </para>
/// </summary>
public static class OpcUaDataPlaneRoles
{
    /// <summary>The role that grants OPC UA Part 9 alarm acknowledge / confirm / shelve / comment
    /// authority. A session must carry this role for the inbound alarm-condition method handlers to
    /// route the command to the engine; absent it, the call is denied with
    /// <c>BadUserAccessDenied</c>.</summary>
    public const string AlarmAck = "AlarmAck";

    /// <summary>The role that grants authority to write a writable equipment-tag variable node
    /// (FreeAccess / Operate attributes). A session must carry this role for the inbound
    /// <c>OnWriteValue</c> handler to route the value to the backing driver; absent it the
    /// write is denied with <c>BadUserAccessDenied</c> before any driver call.</summary>
    public const string WriteOperate = "WriteOperate";
}