/**
 * 员工、岗位与权限(编码规范 §4 · `org`;语义出处 OS 02 员工管理)。
 *
 * 权限按岗位授予:客体三类(数据 域.对象[.字段] / 治理功能 / 任务)× 动作三种(读 / 写 / 治理)。
 * 任务负责人与被征答人对所涉内容**天然可见**,不另行授权。
 * 单组织、≤50 人:不做多租户,不引 OAuth/OIDC(编码规范 §4 鉴权定调)。
 */
import { z } from 'zod';
import { positionIdSchema, staffIdSchema } from './id.ts';

export const positionSchema = z.object({
  id: positionIdSchema,
  code: z.string().min(1),
  name: z.string().min(1),
  note: z.string().optional(),
});
export type Position = z.infer<typeof positionSchema>;

export const STAFF_STATES = ['active', 'disabled'] as const;
export const staffStateSchema = z.enum(STAFF_STATES);
export type StaffState = z.infer<typeof staffStateSchema>;

export const staffSchema = z.object({
  id: staffIdSchema,
  account: z.string().min(1),
  name: z.string().min(1),
  positionId: positionIdSchema,
  state: staffStateSchema.default('active'),
});
export type Staff = z.infer<typeof staffSchema>;

/* ── 岗位授权:客体三类 × 动作三种 ─────────────────────────────────── */

export const GRANT_ACTIONS = ['read', 'write', 'govern'] as const;
export const grantActionSchema = z.enum(GRANT_ACTIONS);
export type GrantAction = z.infer<typeof grantActionSchema>;

export const GRANT_ACTION_LABEL: Readonly<Record<GrantAction, string>> = {
  read: '读',
  write: '写',
  govern: '治理',
};

/** 治理台九功能 —— 授权客体之一 */
export const GOVERNANCE_FUNCTIONS = [
  'task',
  'staff',
  'process',
  'trigger',
  'activity',
  'tool',
  'data',
  'memory',
  'system',
] as const;
export const governanceFunctionSchema = z.enum(GOVERNANCE_FUNCTIONS);
export type GovernanceFunction = z.infer<typeof governanceFunctionSchema>;

export const GOVERNANCE_FUNCTION_LABEL: Readonly<Record<GovernanceFunction, string>> = {
  task: '任务管理',
  staff: '员工管理',
  process: '工作流管理',
  trigger: '触发器配置',
  activity: '活动库管理',
  tool: '工具管理',
  data: '数据管理',
  memory: '记忆管理',
  system: '系统管理',
};

export const grantObjectSchema = z.discriminatedUnion('kind', [
  z.object({
    kind: z.literal('data'),
    domain: z.string().min(1),
    object: z.string().min(1),
    field: z.string().optional(),
  }),
  z.object({ kind: z.literal('governance'), function: governanceFunctionSchema }),
  z.object({ kind: z.literal('task'), activityId: z.string().optional() }),
]);
export type GrantObject = z.infer<typeof grantObjectSchema>;

export const grantSchema = z.object({
  positionId: positionIdSchema,
  object: grantObjectSchema,
  action: grantActionSchema,
});
export type Grant = z.infer<typeof grantSchema>;

/* ── 停用前置检查(OS 02) ─────────────────────────────────────────── */

/** 员工停用前,其在途任务与待答卡须先改派完毕 */
export const disableCheckSchema = z.object({
  staffId: staffIdSchema,
  blocked: z.boolean(),
  openTasks: z.array(z.object({ taskId: z.string(), title: z.string() })).default([]),
  openCards: z.array(z.object({ cardId: z.string(), title: z.string() })).default([]),
  openApprovals: z.array(z.object({ approvalId: z.string(), title: z.string() })).default([]),
});
export type DisableCheck = z.infer<typeof disableCheckSchema>;

/* ── 会话 ─────────────────────────────────────────────────────────────── */

export const sessionSchema = z.object({
  staff: staffSchema,
  position: positionSchema,
  grants: z.array(grantSchema),
});
export type Session = z.infer<typeof sessionSchema>;