namespace AutopilotMonitor.Shared.Models.Graph
{
    /// <summary>
    /// Constant catalog of Microsoft Graph application permission names referenced by the
    /// Autopilot Monitor backend. Centralised so feature toggles, the customer-side grant
    /// script, and the runtime permission detector cannot drift apart.
    /// </summary>
    public static class GraphAppPermissions
    {
        /// <summary>
        /// Core enrollment device-validation permission. Required to read
        /// <c>windowsAutopilotDeviceIdentities</c> (Autopilot Device Validation) and
        /// <c>importedDeviceIdentities</c> (Corporate Identifier Validation). Part of the
        /// publisher manifest's default-consent set — present in the SP's token <c>roles</c>
        /// claim once admin consent has been granted by anyone in the tenant. Used by the
        /// access-check probe to silently reconcile pre-approved consent.
        /// </summary>
        public const string DeviceManagementServiceConfigReadAll = "DeviceManagementServiceConfig.Read.All";

        /// <summary>Read display names + file names of Intune device management scripts (Platform Scripts + Remediations).</summary>
        public const string DeviceManagementScriptsReadAll = "DeviceManagementScripts.Read.All";

        /// <summary>Read Intune configuration profiles (future use — policy display names).</summary>
        public const string DeviceManagementConfigurationReadAll = "DeviceManagementConfiguration.Read.All";

        /// <summary>Read Intune managed apps (future use — Win32 app display names not yet covered).</summary>
        public const string DeviceManagementAppsReadAll = "DeviceManagementApps.Read.All";

        /// <summary>
        /// Read Intune managed device objects (<c>deviceManagement/managedDevices</c>). Optional
        /// add-on permission backing Intune Enrollment Validation, which resolves the managedDevice
        /// id carried in the agent's client certificate in the tenant it claims. Not part of the
        /// default-consent set — must be granted per tenant.
        /// </summary>
        public const string DeviceManagementManagedDevicesReadAll = "DeviceManagementManagedDevices.Read.All";

        /// <summary>
        /// Read Windows 365 Cloud PC objects (<c>virtualEndpoint/cloudPCs</c>). Optional add-on
        /// permission backing the W365 Cloud PC device validator — Cloud PCs are never
        /// Autopilot-registered, so validation resolves them through the service-side Cloud PC
        /// inventory instead.
        /// </summary>
        public const string CloudPCReadAll = "CloudPC.Read.All";

        /// <summary>
        /// Application roles the published app manifest requests — the set a tenant-wide admin
        /// consent grants by itself. Everything else a service principal holds is a tenant-side
        /// add-on grant (<see cref="GraphFeatureCatalog"/>) that no re-consent can produce.
        /// </summary>
        public static readonly string[] DefaultConsentSet = { DeviceManagementServiceConfigReadAll };
    }
}