<?php

namespace Database\Seeders;

use Illuminate\Database\Seeder;
use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;
use Spatie\Permission\PermissionRegistrar;

class PermissionSeeder extends Seeder
{
    /**
     * All permissions grouped by resource.
     */
    private static array $permissions = [
        // Company KYC registrations
        'view_company_registrations',
        'edit_company_registrations',
        'approve_company_registrations',
        'reject_company_registrations',
        'send_company_invite',
        'bulk_upload_company_registrations',
        'export_company_registrations',

        // Employee KYC registrations
        'view_employee_registrations',
        'edit_employee_registrations',
        'approve_employee_registrations',
        'reject_employee_registrations',
        'verify_employee_registrations',
        'send_employee_invite',
        'bulk_upload_employee_registrations',
        'export_employee_registrations',

        // Individual KYC registrations
        'view_individual_registrations',
        'edit_individual_registrations',
        'approve_individual_registrations',
        'reject_individual_registrations',
        'verify_individual_registrations',
        'send_individual_invite',
        'export_individual_registrations',

        // Companies (approved records)
        'view_companies',
        'create_companies',
        'generate_company_registration_link',
        'run_aml_screening',

        // Portal users
        'view_portal_users',
        'resend_portal_user_invitation',

        // Analytics
        'view_analytics',

        // Audit logs
        'view_audit_logs',

        // Documents & KYC files
        'view_documents',
        'upload_documents',
        'download_documents',
        'delete_documents',

        // 2FA management
        'reset_user_2fa',

        // Admin user management
        'view_admin_users',
        'create_admin_users',
        'edit_admin_users',
        'delete_admin_users',
        'assign_roles',

        // Role & permission management
        'view_roles',
        'create_roles',
        'edit_roles',
        'delete_roles',
        'assign_permissions',
    ];

    /**
     * Permissions assigned to each role.
     * super-admin is handled via Gate::before bypass — no explicit permissions needed.
     */
    private static array $roles = [
        'super-admin' => [],

        'kyc-manager' => [
            'view_company_registrations',
            'edit_company_registrations',
            'approve_company_registrations',
            'reject_company_registrations',
            'send_company_invite',
            'bulk_upload_company_registrations',
            'export_company_registrations',

            'view_employee_registrations',
            'edit_employee_registrations',
            'approve_employee_registrations',
            'reject_employee_registrations',
            'verify_employee_registrations',
            'send_employee_invite',
            'bulk_upload_employee_registrations',
            'export_employee_registrations',

            'view_individual_registrations',
            'edit_individual_registrations',
            'approve_individual_registrations',
            'reject_individual_registrations',
            'verify_individual_registrations',
            'send_individual_invite',
            'export_individual_registrations',

            'view_companies',
            'create_companies',
            'generate_company_registration_link',
            'run_aml_screening',

            'view_portal_users',
            'resend_portal_user_invitation',

            'view_analytics',
            'view_audit_logs',

            'view_documents',
            'upload_documents',
            'download_documents',
            'delete_documents',

            'reset_user_2fa',
        ],

        'kyc-reviewer' => [
            'view_company_registrations',
            'approve_company_registrations',
            'reject_company_registrations',

            'view_employee_registrations',
            'approve_employee_registrations',
            'reject_employee_registrations',
            'verify_employee_registrations',

            'view_individual_registrations',
            'approve_individual_registrations',
            'reject_individual_registrations',
            'verify_individual_registrations',

            'run_aml_screening',

            'view_companies',
            'view_portal_users',
            'view_analytics',

            'view_documents',
            'download_documents',
        ],

        'external' => [
            'view_company_registrations',
            'view_employee_registrations',
            'view_individual_registrations',
            'view_companies',
            'view_portal_users',
            'view_analytics',
            'view_audit_logs',
            'view_documents',
        ],

        'analytics-viewer' => [
            'view_analytics',
        ],

        'auditor' => [
            'view_audit_logs',
        ],
    ];

    public function run(): void
    {
        // Reset cached roles and permissions
        app()[PermissionRegistrar::class]->forgetCachedPermissions();

        // Create all permissions
        foreach (self::$permissions as $permission) {
            Permission::firstOrCreate(['name' => $permission, 'guard_name' => 'web']);
        }

        // Create roles and assign permissions
        foreach (self::$roles as $roleName => $rolePermissions) {
            $role = Role::firstOrCreate(['name' => $roleName, 'guard_name' => 'web']);
            $role->syncPermissions($rolePermissions);
        }
    }
}
