<?php

namespace Database\Seeders;

use Illuminate\Database\Seeder;
use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;

class RolePermissionSeeder extends Seeder
{
    /**
     * Permissions are named `{module}.{action}` so future modules just add
     * their own rows here without any schema change.
     */
    private const PERMISSIONS = [
        'users.view', 'users.create', 'users.update', 'users.delete',
        'roles.view', 'roles.assign',
        'dashboard.view',
        'audit.view',
        'system.manage',
    ];

    private const ROLE_PERMISSIONS = [
        // super-admin gets everything, plus a Gate::before bypass (see AuthServiceProvider)
        'super-admin' => self::PERMISSIONS,
        'admin' => [
            'users.view', 'users.create', 'users.update', 'users.delete',
            'roles.view', 'roles.assign',
            'dashboard.view', 'audit.view',
        ],
        'manager' => [
            'users.view', 'users.update',
            'dashboard.view',
        ],
        'user' => [
            'dashboard.view',
        ],
    ];

    public function run(): void
    {
        // Sanctum SPA (cookie) requests authenticate via the 'web' session
        // guard, so roles/permissions must be registered under 'web' to be
        // visible to $user->can()/hasRole() during normal API requests.
        foreach (self::PERMISSIONS as $permission) {
            Permission::findOrCreate($permission, 'web');
        }

        foreach (self::ROLE_PERMISSIONS as $role => $permissions) {
            Role::findOrCreate($role, 'web')->syncPermissions($permissions);
        }
    }
}