"""Single source of truth for roles and their default permissions.

Roles are a FLAT single field on the User model. Two account types:
  - ADMIN  -> full administrative access (manages everyone)
  - "user" -> everyone else; the concrete sub-roles are CANDIDATE / INTERVIEWER / RECRUITER

Each role is mirrored by a Django Group of the same name. A user's effective
permissions come from the Group attached to their role (plus any extra
per-user permissions an admin grants). Admin management is done over the API,
not the Django admin site.
"""

# Role values — keep in sync with apps.users.models.User.Role
ADMIN = "ADMIN"
HIRING_MANAGER = "HIRING_MANAGER"
PROJECT_MANAGER = "PROJECT_MANAGER"
RECRUITER = "RECRUITER"
INTERVIEWER = "INTERVIEWER"
CANDIDATE = "CANDIDATE"
LEGACY_USER = "USER"  # pre-existing rows; treated as a generic non-admin user

# Every role we manage through the API (legacy USER is accepted but not offered).
# Order matters — this is the display order on the Roles page.
MANAGED_ROLES = [ADMIN, HIRING_MANAGER, PROJECT_MANAGER, RECRUITER, INTERVIEWER, CANDIDATE]

# Roles that are NOT admins (the "user" account type)
USER_ROLES = [HIRING_MANAGER, PROJECT_MANAGER, RECRUITER, INTERVIEWER, CANDIDATE, LEGACY_USER]

# Default permission set per role, as "<app_label>.<codename>".
# ADMIN is special-cased to receive ALL permissions, so it's not listed here.
# Missing permissions (apps without migrated tables) are skipped silently.
DEFAULT_ROLE_PERMISSIONS = {
    HIRING_MANAGER: [
        "jobs.add_jobdescription",
        "jobs.change_jobdescription",
        "jobs.delete_jobdescription",
        "jobs.view_jobdescription",
        "clients.add_client",
        "clients.change_client",
        "clients.view_client",
        "users.view_user",
        "audit_logs.view_autheventlog",
        "candidates.add_candidate",
        "candidates.change_candidate",
        "candidates.view_candidate",
        "pipeline.add_jobapplication",
        "pipeline.change_jobapplication",
        "pipeline.view_jobapplication",
        "master_skills.view_masterskill",
        "master_designations.view_masterdesignation",
        "master_annual_ctc.view_masterannualctc",
    ],
    PROJECT_MANAGER: [
        "jobs.add_jobdescription",
        "jobs.change_jobdescription",
        "jobs.view_jobdescription",
        "clients.add_client",
        "clients.change_client",
        "clients.view_client",
        "users.view_user",
        "audit_logs.view_autheventlog",
        "candidates.view_candidate",
        "pipeline.view_jobapplication",
        "master_skills.view_masterskill",
        "master_designations.view_masterdesignation",
        "master_annual_ctc.view_masterannualctc",
    ],
    RECRUITER: [
        "jobs.add_jobdescription",
        "jobs.change_jobdescription",
        "jobs.delete_jobdescription",
        "jobs.view_jobdescription",
        "clients.add_client",
        "clients.change_client",
        "clients.view_client",
        "users.view_user",
        "audit_logs.view_autheventlog",
        "master_skills.add_masterskill",
        "master_skills.change_masterskill",
        "master_skills.delete_masterskill",
        "master_skills.view_masterskill",
        "master_designations.add_masterdesignation",
        "master_designations.change_masterdesignation",
        "master_designations.delete_masterdesignation",
        "master_designations.view_masterdesignation",
        "master_annual_ctc.add_masterannualctc",
        "master_annual_ctc.change_masterannualctc",
        "master_annual_ctc.delete_masterannualctc",
        "master_annual_ctc.view_masterannualctc",
    ],
    INTERVIEWER: [
        "jobs.view_jobdescription",
        "clients.view_client",
        "users.view_user",
        "master_skills.view_masterskill",
        "master_designations.view_masterdesignation",
        "master_annual_ctc.view_masterannualctc",
    ],
    CANDIDATE: [
        "jobs.view_jobdescription",
    ],
}


def is_admin_role(role):
    return role == ADMIN