"""Default RBAC seed — staff roles (Django groups) and their permissions.

Runs automatically after migrations (see core/apps.py) so a fresh backend
always has the baseline operational roles. Idempotent: a role is only
(re)assigned permissions while it still has none, so later edits made through
the admin portal's Roles page are never overwritten. New roles can still be
added via the seed list here or the portal's "New role" button.
"""

from django.contrib.auth.models import Group, Permission


# role name -> list of permission codenames, or the sentinel "*view" for
# "every view_* permission" (read-only auditor).
DEFAULT_ROLES: dict[str, object] = {
    "Support Agent": [
        "view_user", "view_deal", "view_dispute", "view_disputemessage",
    ],
    "Moderator": [
        "view_deal", "view_dispute", "change_dispute",
        "view_disputemessage", "add_disputemessage",
    ],
    "Compliance / KYC": [
        "view_user", "change_user", "view_kycsubmission", "change_kycsubmission",
    ],
    "Risk / Fraud": [
        "view_user", "change_user", "view_deal", "view_dispute",
    ],
    "Finance Ops": [
        "view_deal", "view_transaction", "view_wallet",
    ],
    "Operations Admin": [
        "view_user", "view_deal", "view_dispute", "view_transaction",
        "view_kycsubmission", "view_disputemessage",
    ],
    "Security Admin": [
        "view_user", "view_group", "add_group", "change_group", "delete_group",
        "view_permission",
    ],
    "Auditor (Read-only)": "*view",
}


def seed_default_rbac() -> list[str]:
    """Create any missing default roles. Returns the names created/updated."""
    touched: list[str] = []
    all_view = None

    for role_name, codenames in DEFAULT_ROLES.items():
        group, created = Group.objects.get_or_create(name=role_name)

        # Only assign permissions while the role has none, so admin edits stick.
        if group.permissions.exists():
            continue

        if codenames == "*view":
            if all_view is None:
                all_view = list(Permission.objects.filter(codename__startswith="view_"))
            perms = all_view
        else:
            perms = list(Permission.objects.filter(codename__in=codenames))

        if perms:
            group.permissions.set(perms)
            touched.append(role_name)
        elif created:
            touched.append(role_name)

    return touched