const ALL_ROLES = ["Admin", "Form Builder", "Master Data Manager", "Read-only"];
const WRITERS = ["Admin", "Form Builder"];
const ADMINS = ["Admin"];
const MDM_WRITE = ["Admin", "Master Data Manager"];
/**
 * Method-aware authorization matrix.
 * Each entry: [HTTP method ("*" = any), URL prefix, allowed roles].
 * Entries are evaluated in order — first match wins.
 * Empty roles array [] = public route.
 */
const MATRIX = [
    // Public
    ["*", "/health", []],
    // Forms — read-only endpoints (GET)
    ["GET", "/api/forms/schema", ALL_ROLES],
    ["GET", "/api/forms", ALL_ROLES],
    // Forms — write endpoints
    ["POST", "/api/forms/submissions", WRITERS],
    ["POST", "/api/forms", WRITERS],
    ["PATCH", "/api/forms", WRITERS],
    ["DELETE", "/api/forms", ADMINS],
    // Master data — read
    ["GET", "/api/master-data", ALL_ROLES],
    // Master data — write
    ["POST", "/api/master-data", MDM_WRITE],
    ["PATCH", "/api/master-data", MDM_WRITE],
    ["DELETE", "/api/master-data", ADMINS],
];
export async function authorize(request, reply) {
    const role = request.headers["x-maf-role"] ?? "Read-only";
    const method = request.method.toUpperCase();
    const path = request.url.split("?")[0] ?? "";
    for (const [entryMethod, prefix, allowed] of MATRIX) {
        if (!path.startsWith(prefix))
            continue;
        if (entryMethod !== "*" && entryMethod !== method)
            continue;
        if (allowed.length === 0)
            return; // public
        if (allowed.includes(role))
            return; // authorized
        return void reply.code(403).send({ message: "Forbidden for current role" });
    }
    return void reply.code(403).send({ message: "Forbidden: route not permitted" });
}
