package users

import "fmt"

// Role represents a user's access level. Roles are ordered hierarchically:
// RoleReader < RoleUploader < RoleAdmin.
// New roles can be inserted into roleLevel without changing existing code.
type Role string

const (
	RoleReader   Role = "reader"
	RoleUploader Role = "uploader"
	RoleAdmin    Role = "admin"
)

// roleLevel defines the hierarchy. Higher = more permissions.
var roleLevel = map[Role]int{
	RoleReader:   0,
	RoleUploader: 1,
	RoleAdmin:    2,
}

// AtLeast reports whether r has at least the same privilege level as min.
func (r Role) AtLeast(min Role) bool {
	return roleLevel[r] >= roleLevel[min]
}

// IsValid reports whether r is a known role.
func (r Role) IsValid() bool {
	_, ok := roleLevel[r]
	return ok
}

func (r Role) String() string { return string(r) }

// ParseRole parses a role string. Returns an error for unknown values.
func ParseRole(s string) (Role, error) {
	r := Role(s)
	if !r.IsValid() {
		return "", fmt.Errorf("unbekannte Rolle %q, gültig: reader, uploader, admin", s)
	}
	return r, nil
}