<?php

namespace Database\Seeders\Menu;

class SystemRoleDefinition
{
    /**
     * @return array<string, array<string, mixed>>
     */
    public static function roles(): array
    {
        return [
            'Full Administrator' => [
                'description' => 'Technical support users',
                'is_full_admin' => true,
                'permissions' => 'all',
            ],
            'Manager' => [
                'description' => 'Operational manager with broad access.',
                'is_full_admin' => false,
                'permissions' => [
                    'dashboard' => ['access'],
                    'pos' => ['access', 'checkout', 'cart_discount', 'line_discount', 'voucher', 'loyalty_redeem'],
                    'pos_cash_movements' => ['access', 'create'],
                    // Runs the order board end to end, including committing an
                    // order to an invoice — the one step that moves stock.
                    // `discount` lets the order desk put discounts on orders.
                    'isms_sales_orders' => ['access', 'view', 'view_all', 'create', 'edit', 'update_status', 'invoice', 'cancel', 'discount'],
                    'isms_custom_orders' => ['access', 'view_all'],
                    // Prints the shelf/stock labels their own tills scan.
                    'inventory_barcode_labels' => ['access', 'view', 'create', 'print'],
                    'reports_sales' => ['access'],
                    'reports_purchases' => ['access'],
                    'reports_inventory' => ['access'],
                    'reports_expiry' => ['access'],
                ],
            ],
            'Auditor' => [
                'description' => 'Read-only access to reports and audit logs.',
                'is_full_admin' => false,
                'permissions' => [
                    'dashboard' => ['access'],
                    'reports_sales' => ['access', 'export'],
                    'reports_purchases' => ['access', 'export'],
                    'reports_inventory' => ['access', 'export'],
                    'reports_expiry' => ['access', 'export'],
                    'reports_customers' => ['access', 'export'],
                    'audit_logs' => ['access', 'view', 'export'],
                ],
            ],
            // Field sales rep (mobile). No dashboard access on purpose — they are
            // redirected straight to Sales Orders, the first module they can reach.
            'Sales Person' => [
                'description' => 'Field sales representative — Sales Orders workflow only (mobile).',
                'is_full_admin' => false,
                'permissions' => [
                    // Takes and works their own orders, but cannot invoice one:
                    // committing stock and money stays a manager's call.
                    'isms_sales_orders' => ['access', 'view', 'create', 'edit', 'update_status'],
                    'isms_custom_orders' => ['access'],
                    'isms_customers' => ['access', 'view', 'create', 'edit'],
                    'isms_invoices' => ['access', 'view', 'create', 'add_payment', 'print'],
                ],
            ],
        ];
    }
}
