<?php

declare(strict_types=1);

namespace App\Domain\Auth;

/**
 * RBAC role. Order: Admin > Operator > Viewer (per SPEC §7 RBAC matrix).
 *
 * `satisfies(Role $required)` is the only thing RbacMiddleware needs to
 * call when deciding whether to admit a request. Roles are intentionally
 * a small total order — adding intermediate tiers later requires re-reviewing
 * every endpoint's required-role declaration anyway.
 */
enum Role: string
{
    case Viewer = 'viewer';
    case Operator = 'operator';
    case Admin = 'admin';

    public function satisfies(self $required): bool
    {
        return $this->level() >= $required->level();
    }

    private function level(): int
    {
        return match ($this) {
            self::Viewer => 1,
            self::Operator => 2,
            self::Admin => 3,
        };
    }
}
