import { defineAuthz } from "@wrnexus/authz";

export default defineAuthz({
  permissions: {
    "crm:dashboard": { title: "View dashboard" },
    "contact:read": { title: "View contacts" },
    "contact:write": { title: "Create and edit contacts" },
    "contact:delete": { title: "Delete contacts", risk: "high" },
    "deal:read": { title: "View deals" },
    "deal:write": { title: "Create and edit deals" },
    "admin:access": { title: "Manage CRM access", risk: "high" },
  },
  roles: {
    viewer: ["crm:dashboard", "contact:read", "deal:read"],
    "sales-rep": ["role:viewer", "contact:write", "deal:write"],
    manager: ["role:sales-rep", "contact:delete"],
    admin: ["role:manager", "admin:access"],
  },
});