export type RoleDefinition = {
  /**
   * Permissions granted to this role. Supports exact strings (`'post:update'`),
   * resource wildcards (`'post:*'`) and the global wildcard (`'*'`).
   */
  permissions: string[]
  /** Other roles whose permissions are also granted (single-level or nested inheritance). */
  inherits?: string[]
}

export type RbacConfig<Session = any> = {
  /** Map of role name → definition. */
  roles: Record<string, RoleDefinition>
  /**
   * Extract the role name(s) for a session. Defaults to `session.data.role ?? session.role`.
   * Return a string, an array of strings, or undefined for an unauthenticated request.
   */
  getRoles?: (session: Session | undefined) => string | string[] | undefined
}

/** Shape of the argument Nixxie access-control functions receive. */
export type AccessArgs<Session = any> = { session?: Session }

export type AccessFn<Session = any> = (args: AccessArgs<Session>) => boolean