import { usePage } from '@inertiajs/react';
import type { Auth } from '@/types';

/**
 * Permission checks on the client.
 *
 * This only decides what to show. Every action is authorised again on the
 * server by the policies and by App\Services\JobWorkflow, so hiding a button
 * is a convenience, never a security boundary.
 */
export function usePermissions() {
    const { auth } = usePage<{ auth: Auth }>().props;

    const permissions = auth?.permissions ?? [];
    const roles = auth?.roles ?? [];

    const can = (permission: string): boolean =>
        permissions.includes(permission);

    const canAny = (required: string[]): boolean =>
        required.some((permission) => permissions.includes(permission));

    const hasRole = (role: string): boolean => roles.includes(role);

    const hasAnyRole = (required: string[]): boolean =>
        required.some((role) => roles.includes(role));

    return { can, canAny, hasRole, hasAnyRole, permissions, roles };
}