X-Financial/web/src/utils/accessControl.js

export const DEFAULT_APP_VIEW_ORDER = [
  'overview',
  'workbench',
  'documents',
  'budget',
  'policies',
  'audit',
  'logs',
  'employees',
  'settings'
]

const ALWAYS_VISIBLE_VIEWS = new Set(['workbench', 'documents', 'policies'])
const VIEW_ROLE_RULES = {
  overview: ['finance', 'executive'],
  budget: ['finance', 'executive'],
  audit: ['auditor', 'finance'],
  logs: ['manager'],
  employees: ['manager'],
  settings: ['manager']
}
const CLAIM_MANAGER_ROLE_CODES = new Set(['executive'])
const CLAIM_RETURN_ROLE_CODES = new Set(['finance', 'executive', 'manager', 'approver'])
const CLAIM_LEADER_APPROVAL_ROLE_CODES = new Set(['manager', 'approver'])

function normalizedRoleCodes(user) {
  if (!user) {
    return []
  }

  return Array.isArray(user.roleCodes)
    ? user.roleCodes.map((item) => String(item || '').trim().toLowerCase()).filter(Boolean)
    : []
}

export function isManagerUser(user) {
  return Boolean(user?.isAdmin) || normalizedRoleCodes(user).includes('manager')
}

export function isFinanceUser(user) {
  return normalizedRoleCodes(user).includes('finance')
}

export function isExecutiveUser(user) {
  return normalizedRoleCodes(user).includes('executive')
}

export function canManageExpenseClaims(user) {
  if (Boolean(user?.isAdmin)) {
    return true
  }

  return normalizedRoleCodes(user).some((roleCode) => CLAIM_MANAGER_ROLE_CODES.has(roleCode))
}

export function canDeleteArchivedExpenseClaims(user) {
  return Boolean(user?.isAdmin)
}

export function canReturnExpenseClaims(user) {
  if (Boolean(user?.isAdmin)) {
    return true
  }

  return normalizedRoleCodes(user).some((roleCode) => CLAIM_RETURN_ROLE_CODES.has(roleCode))
}

export function canApproveLeaderExpenseClaims(user) {
  if (Boolean(user?.isAdmin)) {
    return true
  }

  return normalizedRoleCodes(user).some((roleCode) => CLAIM_LEADER_APPROVAL_ROLE_CODES.has(roleCode))
}

export function canAccessAppView(user, viewId) {
  if (!viewId || !user) {
    return false
  }

  if (!DEFAULT_APP_VIEW_ORDER.includes(viewId)) {
    return false
  }

  if (isManagerUser(user)) {
    return true
  }

  if (ALWAYS_VISIBLE_VIEWS.has(viewId)) {
    return true
  }

  const requiredRoles = VIEW_ROLE_RULES[viewId] || []
  const roleCodes = normalizedRoleCodes(user)
  return requiredRoles.some((roleCode) => roleCodes.includes(roleCode))
}

export function getAccessibleViewIds(user) {
  return DEFAULT_APP_VIEW_ORDER.filter((viewId) => canAccessAppView(user, viewId))
}

export function filterNavItemsByAccess(navItems, user) {
  return navItems.filter((item) => canAccessAppView(user, item.id))
}

export function resolveDefaultAuthorizedRoute(user) {
  const firstVisibleView = getAccessibleViewIds(user)[0]
  return { name: `app-${firstVisibleView || 'workbench'}` }
}