package authz

// FallbackCapabilitiesByRoleID 在无 PG RBAC 时按 role_id 返回静态权限（与 IAM 种子对齐）。
func FallbackCapabilitiesByRoleID(roleID string) []string {
	switch roleID {
	case "role-admin":
		return []string{
			"project:create",
			"project:assign_lead",
			PermManage,
			PermSystemOverview,
			PermSystemKBRead,
			PermSystemFeaturesRead,
			PermSystemSettingsRead,
			PermSystemSettingsWrite,
			PermSystemAuditRead,
			"workflow:config_visibility",
			"doc:override_visibility",
			"doc:export",
			"workflow:view_all",
		}
	case "role-director":
		return []string{
			"project:create",
			"project:assign_lead",
			"workflow:config_visibility",
			"doc:override_visibility",
			"doc:export",
			"workflow:view_all",
		}
	case "role-tech-lead":
		return []string{
			"project:create",
			"project:assign_lead",
			"doc:override_visibility",
			"doc:export",
			"workflow:view_all",
		}
	case "role-engineer":
		return []string{"doc:export", "workflow:view_all"}
	case "role-guest":
		return []string{"doc:export"}
	default:
		return nil
	}
}