from __future__ import annotations

LEGACY_SCOPE_ALIASES: dict[str, frozenset[str]] = {
    # Only names that are no longer canonical remain runtime aliases. Canonical
    # permissions keep their narrow meaning; migrations expand old role records
    # once so upgraded installations do not lose prior access.
    "campaign:write": frozenset({
        "campaign:create",
        "campaign:update",
        "campaign:copy",
        "campaign:archive",
        "campaign:delete",
        "campaign:share",
        "recipients:read",
        "recipients:write",
        "recipients:import",
    }),
    "attachments:read": frozenset({"files:read", "files:download"}),
    "attachments:write": frozenset({"files:upload", "files:organize", "files:share", "files:delete"}),
    "admin:users": frozenset({
        "admin:users:read",
        "admin:users:create",
        "admin:users:update",
        "admin:users:suspend",
        "admin:groups:read",
        "admin:groups:write",
        "admin:groups:manage_members",
        "admin:roles:read",
        "admin:roles:write",
        "admin:roles:assign",
    }),
    "admin:users:write": frozenset({
        "admin:users:create",
        "admin:users:update",
        "admin:users:suspend",
        "admin:roles:assign",
        "admin:groups:manage_members",
    }),
    "admin:api_keys:write": frozenset({"admin:api_keys:create", "admin:api_keys:revoke"}),
    "admin:settings": frozenset({
        "admin:settings:read",
        "admin:settings:write",
        "admin:api_keys:read",
        "admin:api_keys:create",
        "admin:api_keys:revoke",
    }),
    "system:tenants:write": frozenset({"system:tenants:create", "system:tenants:update", "system:tenants:suspend"}),
    "system:access:write": frozenset({
        "system:access:assign",
        "system:roles:assign",
        "system:accounts:create",
        "system:accounts:update",
        "system:accounts:suspend",
    }),
}
