<?php

return [
    /*
    |--------------------------------------------------------------------------
    | Source roots
    |--------------------------------------------------------------------------
    |
    | Phase 9 scans runtime application code and Blade views for role-based
    | authorization decisions. Seeder/migration files are intentionally excluded
    | from the default runtime scan because assigning/bootstraping roles is not an
    | authorization decision.
    |
    */
    'source_scan_paths' => [
        'app',
        'routes',
        'resources/views',
    ],

    /*
    |--------------------------------------------------------------------------
    | Approved role-check paths
    |--------------------------------------------------------------------------
    |
    | Keep this list deliberately small. Entries may be an exact repository path
    | or a directory prefix ending in "/". Every exception must include a reason
    | so role-based authorization cannot silently spread through the codebase.
    |
    | Role administration screens should normally query role records for display
    | and assignment; they should not use a user's role name to authorize access.
    |
    */
    'approved_role_check_paths' => [
        'app/Providers/AppServiceProvider.php' => 'Intentional global Gate::before bypass for the protected super-administrator role; ordinary application authorization must remain permission/policy based.',
    ],

    /*
    |--------------------------------------------------------------------------
    | Structural role-reference paths
    |--------------------------------------------------------------------------
    |
    | These paths may legitimately query Role names to manage assignments,
    | defaults, audit metadata, or protected-role invariants. They are classified
    | separately from authorization checks and never treated as approval for
    | hasRole()/role middleware usage.
    |
    */
    'structural_role_reference_paths' => [
        'app/Models/Role.php' => 'Role domain model.',
        'app/Models/User.php' => 'User-role relationship and role assignment domain methods.',
        'app/Console/Commands/AuthorizationInventory.php' => 'Authorization inventory reports role metadata but does not authorize requests by role name.',
        'app/Http/Controllers/Admin/RoleController.php' => 'Role administration surface.',
        'app/Http/Controllers/Admin/UserController.php' => 'User role-assignment administration and role-change audit metadata.',
        'app/Services/Authorization/AuthorizationDelegationService.php' => 'Central protected-role identity and last-active-super-administrator invariants; authorization decisions use permissions.',
        'app/Support/Authorization/' => 'Canonical RBAC catalog and default/effective role matrices.',
    ],
];
