import { FileVisibility, Role } from '@prisma/client';
import { AuthenticatedUser } from '../auth/authenticated-request';

/// Maps the caller's role for a given KC to the file visibility tiers they may see.
/// LEITUNGSTEAM is global (per RolesGuard convention) and sees everything.
export function allowedVisibilitiesForUser(
  user: AuthenticatedUser,
  kcId: string,
): FileVisibility[] {
  const isLt = user.memberships.some((m) => m.role === Role.LEITUNGSTEAM);
  if (isLt) {
    return [FileVisibility.ALLE, FileVisibility.ALLE_AUSSER_KONFIS, FileVisibility.NUR_LT];
  }
  const isTeamMemberForKc = user.memberships.some((m) => m.kcId === kcId);
  if (isTeamMemberForKc) {
    return [FileVisibility.ALLE, FileVisibility.ALLE_AUSSER_KONFIS];
  }
  return [];
}

export const GUEST_ALLOWED_VISIBILITIES: FileVisibility[] = [FileVisibility.ALLE];