export const DEFAULT_OPERATIONS = ['create', 'read', 'update', 'delete', 'list'] as const;

export const RESOURCES = {
	agent: [...DEFAULT_OPERATIONS, 'execute', 'publish', 'unpublish', 'manage'] as const,
	aiAssistant: ['manage'] as const,
	annotationTag: [...DEFAULT_OPERATIONS] as const,
	auditLogs: ['manage'] as const,
	banner: ['dismiss'] as const,
	community: ['register'] as const,
	communityPackage: ['install', 'uninstall', 'update', 'list', 'manage'] as const,
	credential: [
		'share',
		'unshare',
		'shareGlobally',
		'move',
		'connect',
		'createEndUser',
		'manageInstance',
		...DEFAULT_OPERATIONS,
	] as const,
	externalSecretsProvider: ['sync', ...DEFAULT_OPERATIONS] as const,
	externalSecret: ['list'] as const,
	eventBusDestination: ['test', ...DEFAULT_OPERATIONS] as const,
	ldap: ['sync', 'manage'] as const,
	license: ['manage'] as const,
	logStreaming: ['manage'] as const,
	nodeTypePolicy: ['manage'] as const,
	orchestration: ['read', 'list', 'manage'] as const,
	// `manageMembers` gates changes to a project's membership list: adding a member
	// with a role, changing a member's role, and removing a member. Kept separate
	// from `update` so a role can edit project details without being able to
	// hand out project roles.
	project: [...DEFAULT_OPERATIONS, 'export', 'manageMembers'] as const,
	saml: ['manage'] as const,
	securityAudit: ['generate'] as const,
	securitySettings: ['manage'] as const,
	sourceControl: ['pull', 'push', 'manage'] as const,
	gitConnection: [...DEFAULT_OPERATIONS, 'clone', 'push', 'manageProjects', 'pull'] as const,
	tag: [...DEFAULT_OPERATIONS] as const,
	user: [
		'resetPassword',
		'changeRole',
		'enforceMfa',
		'generateInviteLink',
		...DEFAULT_OPERATIONS,
	] as const,
	variable: [...DEFAULT_OPERATIONS] as const,
	projectVariable: [...DEFAULT_OPERATIONS] as const,
	workersView: ['manage'] as const,
	workflow: [
		'share',
		'unshare',
		'execute',
		'execute-chat',
		'export',
		'import',
		'move',
		'activate',
		'deactivate',
		'publish',
		'unpublish',
		'enableRedaction',
		'disableRedaction',
		...DEFAULT_OPERATIONS,
	] as const,
	folder: [...DEFAULT_OPERATIONS, 'move'] as const,
	insights: ['list', 'read'] as const,
	oidc: ['manage'] as const,
	provisioning: ['manage'] as const,
	dataTable: [
		...DEFAULT_OPERATIONS,
		'readRow',
		'writeRow',
		'readColumn',
		'writeColumn',
		'listProject',
	] as const,
	execution: ['delete', 'read', 'retry', 'list', 'get', 'reveal'] as const,
	testRun: ['read', 'list'] as const,
	workflowTags: ['update', 'list'] as const,
	role: ['manage', 'read', 'manageProject', 'list'] as const,
	mcp: ['manage', 'oauth'] as const,
	mcpApiKey: ['create', 'rotate'] as const,
	chatHub: ['manage', 'message'] as const,
	chatHubAgent: [...DEFAULT_OPERATIONS] as const,
	breakingChanges: ['list', 'migrate'] as const,
	apiKey: ['manage', 'list', 'create', 'delete', 'update'] as const,
	encryptionKey: ['manage'] as const,
	credentialResolver: [...DEFAULT_OPERATIONS] as const,
	instanceAi: ['message', 'manage', 'gateway', 'eval'] as const,
	roleMappingRule: [...DEFAULT_OPERATIONS] as const,
	otel: ['manage'] as const,
} as const;

export const API_KEY_RESOURCES = {
	tag: [...DEFAULT_OPERATIONS] as const,
	workflow: [...DEFAULT_OPERATIONS, 'move', 'activate', 'deactivate', 'export', 'import'] as const,
	variable: ['create', 'update', 'delete', 'list'] as const,
	securityAudit: ['generate'] as const,
	securitySettings: ['manage'] as const,
	saml: ['manage'] as const,
	oidc: ['manage'] as const,
	otel: ['manage'] as const,
	ldap: ['manage', 'sync'] as const,
	project: ['create', 'update', 'delete', 'list', 'export', 'manageMembers'] as const,
	user: ['read', 'list', 'create', 'changeRole', 'delete'] as const,
	execution: ['delete', 'read', 'retry', 'list', 'stop'] as const,
	testRun: ['read', 'list', 'create', 'cancel'] as const,
	credential: ['create', 'read', 'update', 'move', 'delete', 'list'] as const,
	eventBusDestination: ['test', 'create', 'read', 'update', 'delete', 'list'] as const,
	sourceControl: ['pull'] as const,
	gitConnection: [...DEFAULT_OPERATIONS, 'clone', 'push', 'manageProjects', 'pull'] as const,
	workflowTags: ['update', 'list'] as const,
	executionTags: ['update', 'list'] as const,
	communityPackage: ['install', 'uninstall', 'update', 'list'] as const,
	dataTable: ['create', 'read', 'update', 'delete', 'list'] as const,
	dataTableRow: ['create', 'read', 'update', 'delete', 'upsert'] as const,
	dataTableColumn: ['create', 'read', 'delete', 'update'] as const,
	folder: ['create', 'delete', 'read', 'update', 'list'] as const,
	insights: ['read'] as const,
	role: ['manage', 'manageProject', 'list', 'read'] as const,
	roleMappingRule: ['create', 'delete', 'list', 'update'] as const,
} as const;

export const GLOBAL_OWNER_ROLE_SLUG = 'global:owner';
export const GLOBAL_ADMIN_ROLE_SLUG = 'global:admin';
export const GLOBAL_CHAT_USER_ROLE_SLUG = 'global:chatUser';
export const PROJECT_OWNER_ROLE_SLUG = 'project:personalOwner';
export const PROJECT_ADMIN_ROLE_SLUG = 'project:admin';
export const PROJECT_EDITOR_ROLE_SLUG = 'project:editor';
export const PROJECT_VIEWER_ROLE_SLUG = 'project:viewer';
export const PROJECT_CHAT_USER_ROLE_SLUG = 'project:chatUser';
export const PERSONAL_SPACE_PUBLISHING_SETTING = {
	key: 'security.personalSpacePublishing',
	scopes: ['workflow:publish', 'agent:publish'],
};
export const PERSONAL_SPACE_SHARING_SETTING = {
	key: 'security.personalSpaceSharing',
	scopes: ['workflow:share', 'credential:share'],
};

export const EXTERNAL_SECRETS_SYSTEM_ROLES_ENABLED_SETTING = {
	key: 'externalSecrets.systemRolesEnabled',
	roleScopeMap: {
		[PROJECT_ADMIN_ROLE_SLUG]: [
			'externalSecretsProvider:create',
			'externalSecretsProvider:read',
			'externalSecretsProvider:update',
			'externalSecretsProvider:delete',
			'externalSecretsProvider:list',
			'externalSecretsProvider:sync',
			'externalSecret:list',
		],
		[PROJECT_EDITOR_ROLE_SLUG]: [
			'externalSecretsProvider:read',
			'externalSecretsProvider:list',
			'externalSecret:list',
		],
	} as Record<string, string[]>,
};