/** Realm roles that may open portal /it (IT inventory). Keycloak: run keycloak-sankofa-ensure-it-admin-role.sh in proxmox repo. */
export const IT_OPS_ALLOWED_ROLES = [
  'sankofa-it-admin',
  'SANKOFA_IT_ADMIN',
  'admin',
  'ADMIN',
] as const;

export function sessionHasItOpsRole(roles: string[] | undefined): boolean {
  const allowed = new Set(IT_OPS_ALLOWED_ROLES.map((r) => r.toLowerCase()));
  return (roles || []).some((r) => allowed.has(r.toLowerCase()));
}
