HOA_Financial_Platform/frontend/src/permissions/resolve-permissions.ts

import { ALL_CAPABILITIES } from './capabilities';
import { DEFAULT_ROLE_CAPABILITIES } from './default-role-capabilities';

export interface PermissionOverrides {
  [role: string]: {
    grant?: string[];
    revoke?: string[];
  };
}

/**
 * Resolve effective capabilities for a role, applying tenant overrides.
 *
 * Mirrors backend/src/common/permissions/resolve-permissions.ts.
 */
export function resolveCapabilities(
  role: string,
  overrides?: PermissionOverrides | null,
): Set<string> {
  const defaults = DEFAULT_ROLE_CAPABILITIES[role] || [];
  const result = new Set<string>(defaults);

  if (overrides && overrides[role]) {
    const roleOverride = overrides[role];

    if (roleOverride.grant) {
      for (const cap of roleOverride.grant) {
        if (ALL_CAPABILITIES.has(cap)) {
          result.add(cap);
        }
      }
    }

    if (roleOverride.revoke) {
      for (const cap of roleOverride.revoke) {
        result.delete(cap);
      }
    }
  }

  return result;
}