<?php

declare(strict_types=1);

namespace Config;

use CodeIgniter\Shield\Config\AuthGroups as ShieldAuthGroups;

class AuthGroups extends ShieldAuthGroups
{
    /**
     * Default group for newly registered users.
     * Registration is disabled, so this mainly applies to manually created accounts.
     */
    public string $defaultGroup = 'student';

    /**
     * Available groups in the system.
     *
     * @var array<string, array<string, string>>
     */
    public array $groups = [
        'super_admin' => [
            'title'       => 'Super Admin',
            'description' => 'Full control of the system.',
        ],
        'admin' => [
            'title'       => 'Admin',
            'description' => 'Upload, review, and approve documents; manage users.',
        ],
        'lecturer' => [
            'title'       => 'Lecturer',
            'description' => 'Upload and review documents.',
        ],
        'student' => [
            'title'       => 'Student',
            'description' => 'Submit academic works and track submission status.',
        ],
    ];

    /**
     * Available permissions.
     *
     * @var array<string, string>
     */
    public array $permissions = [
        'admin.access'       => 'Can access the admin area',
        'documents.manage'   => 'Can upload, edit, and delete any document',
        'documents.review'   => 'Can approve, reject, or request revision on documents',
        'users.manage'       => 'Can create, edit, and deactivate user accounts',
        'logs.view'          => 'Can view activity logs',
        'reports.export'     => 'Can export reports',
        'documents.submit'   => 'Can submit own academic works',
    ];

    /**
     * Permissions matrix — maps groups to their permissions.
     *
     * @var array<string, list<string>>
     */
    public array $matrix = [
        'super_admin' => [
            'admin.access',
            'documents.manage',
            'documents.review',
            'users.manage',
            'logs.view',
            'reports.export',
            'documents.submit',
        ],
        'admin' => [
            'admin.access',
            'documents.manage',
            'documents.review',
            'users.manage',
            'logs.view',
            'reports.export',
        ],
        'lecturer' => [
            'documents.submit',
        ],
        'student' => [
            'documents.submit',
        ],
    ];
}
