export type UserRole = 'admin' | 'super_viewer' | 'operator' | 'viewer';

/** Reserved identity for work requested by the controller. */
export const systemUsername = 'Maxis';

export interface AuthUser {
    id: string;
    username: string;
    displayName: string;
    role: UserRole;
    disabled: boolean;
    mustChangePassword: boolean;
    createdAt: string;
    updatedAt: string;
    lastLoginAt: string | null;
}

export const roleLabels: Record<UserRole, string> = {
    admin: 'Administrator',
    super_viewer: 'Super Viewer',
    operator: 'Operator',
    viewer: 'Viewer'
};

export function canOperate(role: UserRole | null | undefined): boolean {
    return role === 'admin' || role === 'operator';
}

export function canReadAdmin(role: UserRole | null | undefined): boolean {
    return role === 'admin' || role === 'super_viewer';
}

export function canReadSensitive(role: UserRole | null | undefined): boolean {
    return canOperate(role) || role === 'super_viewer';
}