/**
 * User Role Types (RBAC)
 * 
 * USER: Default role - standard workflow participant
 * MANAGEMENT: Enhanced visibility - read access to all data
 * ADMIN: Full system access - configuration and user management
 */
export type UserRole = 'USER' | 'MANAGEMENT' | 'ADMIN';

export interface User {
  userId: string;
  employeeId: string;
  email: string;
  firstName: string;
  lastName: string;
  displayName: string;
  department?: string;
  designation?: string;
  phone?: string;
  reportingManagerId?: string;
  isActive: boolean;
  role: UserRole; // RBAC: USER, MANAGEMENT, ADMIN
  lastLogin?: Date;
  createdAt: Date;
  updatedAt: Date;
}

export interface CreateUserData {
  employeeId: string;
  email: string;
  firstName: string;
  lastName: string;
  displayName: string;
  department?: string;
  designation?: string;
  phone?: string;
  reportingManagerId?: string;
  role?: UserRole; // Optional on creation, defaults to 'USER'
}

export interface UpdateUserData {
  email?: string;
  firstName?: string;
  lastName?: string;
  displayName?: string;
  department?: string;
  designation?: string;
  phone?: string;
  reportingManagerId?: string;
  isActive?: boolean;
  role?: UserRole; // RBAC: Can update user role (ADMIN only)
  manager?: string;
  secondEmail?: string;
  jobTitle?: string;
  employeeNumber?: string;
  postalAddress?: string;
  mobilePhone?: string;
  adGroups?: string[];
}
