package user

import (
	"git.golem15.com/golem15/sm-user-plugin/classes"
	"git.golem15.com/golem15/sm-user-plugin/controllers"
	"git.golem15.com/golem15/summercms/modules/pact"
)

const userPermissionTab = "golem15.user::lang.plugin.tab"

// Permissions is the plugin's Winter registerPermissions() catalog plus one
// code of its own. The four PHP codes default to the developer role;
// impersonate_user is registered so imported backend roles that name it stay
// valid, although no screen uses it. manage_privileged_groups has no default
// role: only a superuser, or a role that was granted it explicitly, may
// change the email or password of a privileged-group member or delete one.
func (*Plugin) Permissions() []pact.Permission {
	return []pact.Permission{
		{
			Code:  controllers.PermissionAccessUsers,
			Tab:   userPermissionTab,
			Label: "golem15.user::lang.plugin.access_users",
			Roles: []string{"developer"},
		},
		{
			Code:  "golem15.users.access_groups",
			Tab:   userPermissionTab,
			Label: "golem15.user::lang.plugin.access_groups",
			Roles: []string{"developer"},
		},
		{
			Code:  "golem15.users.access_settings",
			Tab:   userPermissionTab,
			Label: "golem15.user::lang.plugin.access_settings",
			Roles: []string{"developer"},
		},
		{
			Code:  "golem15.users.impersonate_user",
			Tab:   userPermissionTab,
			Label: "golem15.user::lang.plugin.impersonate_user",
			Roles: []string{"developer"},
		},
		{
			Code:  classes.PermissionManagePrivilegedGroups,
			Tab:   userPermissionTab,
			Label: "golem15.user::lang.plugin.manage_privileged_groups",
		},
	}
}