import type { ApiKey } from "./types";

/** Berechtigungen, die ein API-Schlüssel tragen kann - wie API_KEY_SCOPES im Backend. */
export const API_KEY_SCOPES = ["shop-sync:read", "shop-sync:write", "erp-inventory:read"] as const;

export type ApiKeyScope = (typeof API_KEY_SCOPES)[number];

export const API_KEY_SCOPE_LABELS: Record<ApiKeyScope, string> = {
  "shop-sync:read": "Shop-Daten lesen (Wabenhain)",
  "shop-sync:write": "Verkäufe und Rückbuchungen buchen (Wabenhain)",
  "erp-inventory:read": "Inventar-Spiegel lesen (ERPNext)",
};

/** Buchende Rechte - wie API_KEY_WRITE_SCOPES im Backend; alle anderen lesen nur. */
const WRITE_SCOPES: readonly string[] = ["shop-sync:write"];

/** Label für die Anzeige; unbekannte Rechte (neueres Backend) unverändert. */
export function apiKeyScopeLabel(scope: string): string {
  return (API_KEY_SCOPE_LABELS as Record<string, string>)[scope] ?? scope;
}

/**
 * Keys issued before reading and booking were split may still carry both;
 * the server no longer creates such keys, the UI nudges towards two keys.
 * The ERP inventory scope counts as reading.
 */
export function hasReadAndWriteScopes(apiKey: Pick<ApiKey, "scopes">): boolean {
  const isWrite = (scope: string) => WRITE_SCOPES.includes(scope);
  return apiKey.scopes.some(isWrite) && apiKey.scopes.some((scope) => !isWrite(scope));
}