"""Central permission configuration for all service routes.

Every route must be listed here. test_00_discover_routes.py enforces this.

Format:
    ROUTE_PERMISSIONS[(method, path)] = (role1, role2, ...)
    - "anonymous" means no auth required (public)
    - "authenticated" means any logged-in user

Adding a new route? Add it here first — the discover test will fail otherwise.
"""

ROLES = ("owner", "engineer", "technician")

ROUTE_PERMISSIONS: dict[tuple[str, str], tuple[str, ...]] = {
    # === PUBLIC ===
    ("GET", "/health"):                    ("anonymous",),
    ("GET", "/service/login"):             ("anonymous",),
    ("POST", "/service/login"):            ("anonymous",),
    ("GET", "/"):                          ("anonymous",),

    # === AUTH ===
    ("GET", "/service/logout"):            ("authenticated",),

    # === DASHBOARD ===
    ("GET", "/service/dashboard"):         ("owner", "engineer", "technician"),

    # === USERS ===
    ("GET", "/service/users"):             ("owner",),
    ("POST", "/service/users/create"):     ("owner",),
    ("POST", "/service/users/edit"):       ("owner",),
    ("POST", "/service/users/delete"):     ("owner",),

    # === CUSTOMERS ===
    ("GET", "/service/customers"):          ("owner", "engineer"),
    ("POST", "/service/customers/create"):  ("owner", "engineer"),
    ("POST", "/service/customers/edit"):    ("owner", "engineer"),
    ("POST", "/service/customers/delete"):  ("owner",),

    # === OBJECTS ===
    ("GET", "/service/objects"):            ("owner", "engineer"),
    ("POST", "/service/objects/create"):    ("owner", "engineer"),
    ("POST", "/service/objects/edit"):      ("owner", "engineer"),
    ("POST", "/service/objects/delete"):    ("owner",),

    # === ASSIGNMENTS ===
    ("GET", "/service/assignments"):           ("owner",),
    ("POST", "/service/assignments/create"):   ("owner",),
    ("POST", "/service/assignments/unassign"): ("owner",),

    # === SLA ===
    ("GET", "/service/sla"):              ("owner", "engineer"),
    ("POST", "/service/sla/create"):      ("owner", "engineer"),
    ("POST", "/service/sla/edit"):        ("owner", "engineer"),

    # === CEO ===
    ("GET", "/service/ceo"):       ("owner",),
    ("POST", "/service/ceo/calc"): ("owner",),
    ("POST", "/service/ceo/kpi"):  ("owner",),

    # === COEFFICIENTS ===
    ("GET", "/service/coefficients"):              ("owner",),
    ("POST", "/service/coefficients/edit"):        ("owner",),
    ("POST", "/service/coefficients/toggle"):      ("owner",),
    ("POST", "/service/coefficients/create"):      ("owner",),
    ("POST", "/service/coefficients/delete"):      ("owner",),
    ("GET", "/service/coefficients/test"):         ("owner",),
    ("POST", "/service/coefficients/test/{formula_name}"): ("owner",),

    # === FORMULAS ===
    ("GET", "/service/formulas"): ("owner",),

    # === TASKS ===
    ("GET", "/service/tasks"):          ("owner", "engineer", "technician"),
    ("POST", "/service/tasks/create"):  ("owner", "engineer"),
    ("POST", "/service/tasks/close"):   ("owner", "engineer", "technician"),

    # === REPORTS ===
    ("GET", "/service/reports"):          ("owner", "engineer", "technician"),
    ("POST", "/service/reports/create"):  ("owner", "engineer", "technician"),

    # === INCIDENTS ===
    ("GET", "/service/incidents"):            ("owner", "engineer", "technician"),
    ("POST", "/service/incidents/create"):    ("owner", "engineer"),
    ("POST", "/service/incidents/resolve"):   ("owner", "engineer", "technician"),

    # === QUESTIONNAIRE ===
    ("GET", "/service/questionnaire"):               ("owner", "engineer"),
    ("GET", "/service/questionnaire/step/{step}"):   ("owner", "engineer"),
    ("POST", "/service/questionnaire/save/{step}"):  ("owner", "engineer"),

    # === QUESTIONNAIRE CONFIG ===
    ("GET", "/service/questionnaire-config"):          ("owner",),
    ("POST", "/service/questionnaire-config/create"):  ("owner",),
    ("POST", "/service/questionnaire-config/edit"):    ("owner",),
    ("POST", "/service/questionnaire-config/toggle"):  ("owner",),
    ("POST", "/service/questionnaire-config/delete"):  ("owner",),

    # === PASSPORTS ===
    ("GET", "/service/passports"): ("owner", "engineer"),

    # === CHECKLIST ===
    ("GET", "/service/checklist"):          ("owner", "technician"),
    ("POST", "/service/checklist/complete"): ("owner", "technician"),

    # === BLOG ===
    ("GET", "/service/blog"):         ("owner",),
    ("POST", "/service/blog/create"): ("owner",),
    ("POST", "/service/blog/edit"):   ("owner",),
    ("POST", "/service/blog/delete"): ("owner",),

    # === QUICK MENU ===
    ("GET", "/service/quick-menu"):              ("owner", "engineer"),
    ("POST", "/service/quick-menu/save"):        ("owner", "engineer"),
    ("GET", "/service/api/quick-menu"):          ("authenticated",),
    ("GET", "/service/quick-menu/tech"):         ("engineer",),
    ("POST", "/service/quick-menu/tech-save"):   ("engineer",),

    # === IDEAS ===
    ("GET", "/service/ideas"):         ("owner",),
    ("POST", "/service/ideas/create"): ("owner",),
    ("POST", "/service/ideas/edit"):   ("owner",),
    ("POST", "/service/ideas/status"): ("owner",),
    ("POST", "/service/ideas/delete"): ("owner",),

    # === CHARTS ===
    ("GET", "/service/charts"):          ("owner",),
    ("GET", "/service/api/charts/data"): ("owner",),

    # === CASES ===
    ("GET", "/service/cases"):         ("owner",),
    ("POST", "/service/cases/create"): ("owner",),
    ("POST", "/service/cases/edit"):   ("owner",),
    ("POST", "/service/cases/delete"): ("owner",),

    # === BOT SETTINGS (pages) ===
    ("GET", "/service/bot-settings"):               ("owner",),
    ("GET", "/service/bot-settings/responses"):     ("owner",),
    ("GET", "/service/bot-settings/features"):      ("owner",),
    ("GET", "/service/bot-settings/categories"):    ("owner",),
    ("GET", "/service/bot-settings/kb"):            ("owner",),
    ("GET", "/service/bot-settings/conversations"): ("owner",),
    ("GET", "/service/bot-settings/users"):         ("owner",),
    ("GET", "/service/bot-settings/test-runner"):   ("owner",),
    ("GET", "/service/bot-settings/analytics"):     ("owner",),

    # === PORTAL / ROLE SETTINGS ===
    ("GET", "/service/portal-settings"): ("owner",),
    ("GET", "/service/role-settings"):   ("owner",),

    # === ROLE PERMISSIONS API ===
    ("GET", "/service/api/role-permissions"):       ("owner",),
    ("POST", "/service/api/role-permissions/save"): ("owner",),

    # === ROLE SWITCH API ===
    ("POST", "/service/api/role/switch"):  ("owner", "engineer"),
    ("POST", "/service/api/role/reset"):   ("authenticated",),

    # === BOT API (proxied) ===
    ("GET", "/service/api/bot/settings"):               ("owner",),
    ("POST", "/service/api/bot/settings/save"):         ("owner",),
    ("GET", "/service/api/bot/templates"):              ("owner",),
    ("POST", "/service/api/bot/templates/save"):        ("owner",),
    ("GET", "/service/api/bot/features"):               ("owner",),
    ("POST", "/service/api/bot/features/toggle"):       ("owner",),
    ("GET", "/service/api/bot/categories"):             ("owner",),
    ("POST", "/service/api/bot/categories/create"):     ("owner",),
    ("POST", "/service/api/bot/categories/edit"):       ("owner",),
    ("POST", "/service/api/bot/categories/delete"):     ("owner",),
    ("GET", "/service/api/bot/kb"):                     ("owner",),
    ("POST", "/service/api/bot/kb/create"):             ("owner",),
    ("POST", "/service/api/bot/kb/edit"):               ("owner",),
    ("POST", "/service/api/bot/kb/delete"):             ("owner",),
    ("GET", "/service/api/bot/conversations"):          ("owner",),
    ("GET", "/service/api/bot/users"):                  ("owner",),
    ("GET", "/service/api/bot/analytics"):              ("owner",),
    ("POST", "/service/api/bot/test-run"):              ("owner",),
    ("GET", "/service/api/bot/broadcast/recipients"):   ("owner",),
    ("GET", "/service/api/bot/broadcast/history"):      ("owner",),
    ("POST", "/service/api/bot/broadcast"):             ("owner",),

    # === OTHER API (main.py) ===
    ("GET", "/service/api/shs"):       ("owner", "engineer", "technician"),
    ("GET", "/service/api/tasks"):     ("owner", "engineer", "technician"),
    ("GET", "/service/api/changelog"): ("authenticated",),

    # === DOCUMENTS ===
    ("GET", "/service/documents/"):                  ("owner", "engineer", "technician"),
    ("GET", "/service/documents/admin/permissions"):   ("owner",),
    ("POST", "/service/documents/admin/permissions"):  ("owner",),
    ("POST", "/service/documents/admin/create"):       ("owner",),
    ("GET", "/service/documents/tech-access"):         ("engineer",),
    ("POST", "/service/documents/tech-access"):        ("engineer",),
    ("GET", "/service/documents/{slug}"):              ("owner", "engineer", "technician"),
    ("GET", "/service/documents/{slug}/edit"):         ("owner", "engineer"),
    ("POST", "/service/documents/{slug}/edit"):        ("owner", "engineer"),
    ("GET", "/service/documents/{slug}/download"):     ("owner",),
}

# Routes with path parameters — skipped in strict permission test
# but still verified to exist in discover test.
DYNAMIC_ROUTES: set[tuple[str, str]] = {
    ("POST", "/service/coefficients/test/{formula_name}"),
    ("GET", "/service/questionnaire/step/{step}"),
    ("POST", "/service/questionnaire/save/{step}"),
    ("GET", "/service/documents/{slug}"),
    ("GET", "/service/documents/{slug}/edit"),
    ("POST", "/service/documents/{slug}/edit"),
    ("GET", "/service/documents/{slug}/download"),
}

# Routes excluded from discover test (internal framework routes)
EXCLUDED_ROUTES: set[tuple[str, str]] = {
    ("GET", "/docs"),
    ("GET", "/docs/oauth2-redirect"),
    ("GET", "/openapi.json"),
    ("GET", "/redoc"),
}