export const globalCapabilities = [
  'global.oidc-client.read',
  'global.oidc-client.manage',
  'global.organization.read',
  'global.organization.manage',
  'global.alert.read',
  'global.alert.manage',
  'global.user.read',
  'global.user.manage',
  'global.user.delete',
  'global.admin.manage',
  'global.signing-key.rotate',
  'global.break-glass.request',
  'global.break-glass.approve',
] as const;

export type TGlobalCapability = (typeof globalCapabilities)[number];

export const delegableGlobalCapabilities = [
  'global.oidc-client.read',
  'global.oidc-client.manage',
  'global.organization.read',
  'global.organization.manage',
  'global.alert.read',
  'global.alert.manage',
  'global.user.read',
  'global.user.manage',
  'global.break-glass.request',
] as const satisfies readonly TGlobalCapability[];

export type TDelegableGlobalCapability =
  (typeof delegableGlobalCapabilities)[number];

/**
 * Capabilities that may be activated temporarily through the two-person
 * break-glass protocol. Authority to delete accounts, manage administrators,
 * rotate signing keys, or approve break-glass access is never eligible.
 */
export const breakGlassEligibleGlobalCapabilities = [
  'global.oidc-client.manage',
  'global.organization.manage',
  'global.alert.manage',
  'global.user.manage',
] as const satisfies readonly TGlobalCapability[];

export type TBreakGlassEligibleGlobalCapability =
  (typeof breakGlassEligibleGlobalCapabilities)[number];

export const tenantCapabilities = [
  'tenant.organization.read',
  'tenant.organization.manage',
  'tenant.organization.delete',
  'tenant.organization.export',
  'tenant.role.read',
  'tenant.role.manage',
  'tenant.membership.read',
  'tenant.membership.manage',
  'tenant.ownership.transfer',
  'tenant.app-connection.read',
  'tenant.app-connection.manage',
  'tenant.sso.read',
  'tenant.sso.manage',
  'tenant.scim-token.read',
  'tenant.scim-token.manage',
  'tenant.billing.read',
  'tenant.billing.manage',
  'tenant.alert.read',
  'tenant.alert.manage',
] as const;

export type TTenantCapability = (typeof tenantCapabilities)[number];

export const delegableTenantCapabilities = [
  'tenant.organization.read',
  'tenant.organization.manage',
  'tenant.organization.export',
  'tenant.role.read',
  'tenant.role.manage',
  'tenant.membership.read',
  'tenant.membership.manage',
  'tenant.app-connection.read',
  'tenant.app-connection.manage',
  'tenant.sso.read',
  'tenant.sso.manage',
  'tenant.scim-token.read',
  'tenant.scim-token.manage',
  'tenant.billing.read',
  'tenant.billing.manage',
  'tenant.alert.read',
  'tenant.alert.manage',
] as const satisfies readonly TTenantCapability[];

export type TDelegableTenantCapability =
  (typeof delegableTenantCapabilities)[number];