<?php

namespace Config;

class Acl
{
    public array $rules = [

        // ===================== PUBLIC / AUTH =====================
        '#^/login#' => ['public' => true],
        '#^/logout#' => ['public' => true],
        '#^/auth#' => ['public' => true],
        '#^/oauth2callback#' => ['public' => true],
        '#^/loginPos#' => ['public' => true],
        '#^/getVerifyPosMobileNo#' => ['public' => true],
        '#^/getVerifiedPosUserData#' => ['public' => true],
        '#^/swagger#' => ['roles' => [ADMIN_ROLE_ID, HEAD_ROLE_ID]],
        '#^/fedeploy#' => ['roles' => [ADMIN_ROLE_ID, HEAD_ROLE_ID]],

        // ===================== PUBLIC DOWNLOADS / FORMS =====================
        '#^/download-#' => ['public' => true],
        '#^/claim-form-download#' => ['public' => true],
        '#^/claims-feedback-form#' => ['public' => true],
        '#^/autobookstackLogin#' => ['public' => true],
        '#^/sendCroneRemainderMail#' => ['public' => true],
        '#^/sendEnrollmentClosedHrMail#' => ['public' => true],
        '#^/testSendEnrollmentClosedHrMail#' => ['public' => true],
        '#^/download_file#' => ['public' => true],

        // ===================== DASHBOARD =====================
        '#^/dashboard#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, STAFF_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => []
        ],

        // ===================== USER MANAGEMENT =====================
        '#^/user#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID],
            'teams' => []
        ],

        // ===================== CLIENT =====================
        '#^/client#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => []
        ],

        // ===================== EMPLOYEE / ENROLLMENT =====================
        '#^/employee#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => [ENROLLMENT_TEAM_ID]
        ],

        // ===================== MASTERS =====================
        '#^/master#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
            'teams' => []
        ],
        '#^/util#' => [
            'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID, MANAGER_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID,STAFF_ROLE_ID],
            'teams' => []
        ],

        // ===================== LOGS =====================
        '#^/logs#' => [
            'roles' => [ADMIN_ROLE_ID, HEAD_ROLE_ID],
            'teams' => []
        ],

        // ===================== RATE LIMIT ADMIN =====================
        '#^/security/rate-limits#' => [
            'roles' => [ADMIN_ROLE_ID],
            'teams' => []
        ],

        // ===================== LOGIN DIAGNOSTIC =====================
        '#^/security/login-diagnostic#' => [
            'roles' => [ADMIN_ROLE_ID, HEAD_ROLE_ID],
            'teams' => []
        ],

        // ===================== INTERNAL TEST =====================
        '#^/test#' => [
            'roles' => [ADMIN_ROLE_ID, HEAD_ROLE_ID],
            'teams' => []
        ],

        // ===================== API (JWT / SIGNED) =====================
        '#^/api#' => ['public' => true],
        '#^/employeeRest#' => ['public' => true],
        '#^/clientApi#' => ['public' => true],
        // ===================== CLI =====================
        '#^/cli/#' => ['public' => true],

        // ===================== DEFAULT DENY (ZERO TRUST) =====================
        '#^/#' => [
            'roles' => [ADMIN_ROLE_ID, HEAD_ROLE_ID],
            'teams' => []
        ],
        // ===================== SAML =====================
        '#^/saml#' => ['public' => true],
    ];
}