<?php
namespace App\Core;

/**
 * The canonical list of fine-grained permissions an admin can grant per role
 * (BRD section 9's permission matrix, made actually configurable rather than
 * hardcoded). ADMIN is deliberately not a row here — it always passes every
 * check (see Auth::can()) so the matrix can never be configured into a state
 * that locks every account out of managing the system.
 */
class Permissions
{
    /** @return array<string,array{label:string,description:string}> */
    public static function all(): array
    {
        return [
            'ticket.assign' => [
                'label' => 'Assign / reassign tickets',
                'description' => 'Move a ticket to a different agent from the ticket detail screen.',
            ],
            'ticket.escalate' => [
                'label' => 'Escalate tickets',
                'description' => 'Manually escalate a ticket to the next level.',
            ],
            'ticket.resolve_close' => [
                'label' => 'Resolve / close tickets',
                'description' => 'Move a ticket to Resolved (with resolution code + root cause) or Closed.',
            ],
            'billing.mark_billable' => [
                'label' => 'Mark effort as billable',
                'description' => 'Override whether a logged effort entry counts as billable, outside entitlement.',
            ],
            'sla.configure' => [
                'label' => 'Configure SLA policies',
                'description' => 'Create or edit SLA policies, targets and the escalation matrix.',
            ],
        ];
    }

    public static function isValid(string $key): bool
    {
        return array_key_exists($key, self::all());
    }
}
