<?php

namespace App\Support\Authorization;

final class EffectiveRoleMatrix
{
    /**
     * Resolve the effective system-role matrix while preserving the reviewed
     * historical DefaultRoleMatrix as the access-parity baseline.
     *
     * @return array<string, array{display_name:string,description:?string,permissions:array<int,string>}>
     */
    public static function roles(): array
    {
        $roles = DefaultRoleMatrix::roles();

        foreach ($roles as $roleName => &$definition) {
            if ($roleName === 'super-administrator') {
                continue;
            }

            $permissions = collect($definition['permissions']);

            // Dashboard and global search were authenticated-only before Phase 8,
            // so all ordinary system roles retain that existing effective access.
            $permissions->push(
                PermissionName::DASHBOARD_VIEW->value,
                PermissionName::SEARCH_USE->value,
            );

            // Credit scoring is lending decision support. Grant it to roles that
            // create applications or make approval decisions, not to generic
            // customer readers such as cashier/accounting roles.
            if ($permissions->contains(PermissionName::LOANS_CREATE->value)
                || $permissions->contains(PermissionName::LOANS_APPROVE->value)) {
                $permissions->push(
                    PermissionName::CREDIT_SCORE_VIEW->value,
                    PermissionName::CREDIT_SCORE_HISTORY->value,
                    PermissionName::CREDIT_SCORE_RECALCULATE->value,
                );
            }

            // Export routes previously shared the corresponding view permission.
            if ($permissions->contains(PermissionName::REPORTS_VIEW->value)) {
                $permissions->push(PermissionName::REPORTS_EXPORT->value);
            }
            if ($permissions->contains(PermissionName::FIXED_ASSETS_VIEW->value)) {
                $permissions->push(
                    PermissionName::FIXED_ASSETS_REPORTS_VIEW->value,
                    PermissionName::FIXED_ASSETS_REPORTS_EXPORT->value,
                );
            }

            // Preserve current broad-role behavior while routes migrate to the
            // Phase 8 granular capabilities. Broad permissions remain deprecated
            // compatibility umbrellas until the cleanup phase.
            if ($permissions->contains(PermissionName::TASKS_MANAGE->value)) {
                $permissions->push(
                    PermissionName::TASKS_CREATE->value,
                    PermissionName::TASKS_UPDATE->value,
                    PermissionName::TASKS_ASSIGN->value,
                    PermissionName::TASKS_UPDATE_STATUS->value,
                );
            }
            if ($permissions->contains(PermissionName::APPOINTMENTS_MANAGE->value)) {
                $permissions->push(
                    PermissionName::APPOINTMENTS_CREATE->value,
                    PermissionName::APPOINTMENTS_UPDATE->value,
                    PermissionName::APPOINTMENTS_MANAGE_STATUS->value,
                );
            }
            if ($permissions->contains(PermissionName::MANAGEMENT_ALERTS_MANAGE->value)) {
                $permissions->push(
                    PermissionName::MANAGEMENT_ALERTS_ACKNOWLEDGE->value,
                    PermissionName::MANAGEMENT_ALERTS_RESOLVE->value,
                    PermissionName::MANAGEMENT_ALERTS_SETTINGS->value,
                );
            }

            $definition['permissions'] = $permissions->unique()->values()->all();
        }
        unset($definition);

        return $roles;
    }
}
