// src/lib/permissions.ts
// Organization access-control: roles owner | admin | member.
// Billing is reserved to the owner — admin and member have no billing access.
import { createAccessControl } from "better-auth/plugins/access";
import {
  adminAc,
  defaultStatements,
  memberAc,
  ownerAc,
} from "better-auth/plugins/organization/access";

export const statement = {
  ...defaultStatements,
  billing: ["view", "manage"],
  // Lier Google Search Console (connexion du compte + mapping de propriété).
  gsc: ["link"],
} as const;

export const ac = createAccessControl(statement);

/** member = default member rights, NO billing, NO gsc:link. */
export const member = ac.newRole({ ...memberAc.statements });

/** admin = default admin rights + gsc:link. NO billing (owner-only — spec RBAC §3). */
export const admin = ac.newRole({
  ...adminAc.statements,
  gsc: ["link"],
});

/** owner = full org rights + billing + gsc:link. */
export const owner = ac.newRole({
  ...ownerAc.statements,
  billing: ["view", "manage"],
  gsc: ["link"],
});

export const roles = { owner, admin, member };