// --- ASA GENERATED START ---
// Permission registry — canonical permissions for admin-basic module.
// Guards check permissions, NOT role strings.
// --- ASA GENERATED END ---

// --- USER CODE START ---

/**
 * Canonical permission IDs.
 * These match the seeded permissions in 004_user_roles.sql.
 * Guards should import and use these constants — never raw strings.
 */
export const PERMISSIONS = {
  ADMIN_ACCESS: 'admin.access',
  USERS_LIST: 'admin.users.list',
  USERS_EDIT: 'admin.users.edit',
  USERS_DELETE: 'admin.users.delete',
  ROLES_ASSIGN: 'admin.roles.assign',
  IMPERSONATE: 'admin.impersonate',
  AUDIT_VIEW: 'admin.audit.view',
  BILLING_MANAGE: 'admin.billing.manage',
  SETTINGS_EDIT: 'admin.settings.edit',
} as const;

export type Permission = typeof PERMISSIONS[keyof typeof PERMISSIONS];

// --- USER CODE END ---
