<?php

return [

    /*
    |--------------------------------------------------------------------------
    | Permission
    |--------------------------------------------------------------------------
    |
    | Holding this permission makes a user eligible for the cross-branch view.
    | Eligibility also requires the academy to have at least two active
    | branches — see BranchContext::canViewAllBranches().
    |
    */

    'permission' => 'branches.view_all',

    /*
    |--------------------------------------------------------------------------
    | Redirect target
    |--------------------------------------------------------------------------
    |
    | Where a locked user is sent when they reach for a branch-scoped page.
    | Must itself appear in `unlocked` below, or the redirect loops.
    |
    */

    'redirect_route' => 'executive.dashboard',

    /*
    |--------------------------------------------------------------------------
    | Routes reachable without a branch
    |--------------------------------------------------------------------------
    |
    | Read by BOTH the sidebar and RequireBranchSelection, so menu visibility
    | and route access cannot drift apart. Patterns are matched with Str::is().
    |
    | Everything operational is absent on purpose: it belongs to a branch, and
    | showing it un-scoped would be showing the wrong numbers.
    |
    */

    'unlocked' => [
        // The cross-branch view itself.
        'executive.*',

        // Reports already take an optional branch and handle "all" correctly.
        'reports.*',
        'export.*',

        // The member-facing portal. It is scoped by membership, not by branch,
        // and RequireBranchSelection runs on the whole web group — so without
        // this any user holding branches.view_all in all-branches mode is
        // bounced straight back out of the portal by middleware.
        'portal.*',
        'parent.*',

        // Academy-level administration.
        'branches.*',
        'users.*',
        'roles.*',
        'audit.*',
        'settings.*',
        'setup.wizard',
        'admin.*',

        // Academy-level CMS — no branch semantics at all.
        'website.manage.*',

        // Landing route; it redirects onward silently rather than flashing an
        // error at someone who merely typed /dashboard.
        'dashboard',

        // The topbar bell links here; a dead bell in locked mode reads as a bug.
        'notifications.center',

        // Always reachable.
        'profile',
        'profile.*',
        'logout',
        'health',

        // Livewire's own update endpoint. Block this and every locked page is
        // inert — no clicks, no dropdowns, not even the branch switcher.
        'livewire.*',
    ],

];
