import type { AuthUser } from '@easyai-ai-gateway/contracts';

// Keep this aligned with backend roles that grant PermissionPower for read-only
// admin APIs; manager/admin additionally receive write access.
const adminWorkspaceRoles = new Set(['admin', 'manager', 'operator']);

export function canAccessAdminWorkspace(user: AuthUser | null | undefined) {
  return user?.role?.some((role) => adminWorkspaceRoles.has(role)) ?? false;
}
