HADOS Role Permissions: Four-Tier RBAC Full Reference

// HabboUser interface (excerpt)
role: 'global_admin' | 'dado_admin' | 'intermediario' | 'jugador';

const getActiveRole = (): 'global_admin' | 'dado_admin' | 'intermediario' | 'jugador' => {
  // 1. No profile loaded yet → default to jugador
  if (!userProfile) return 'jugador';

  // 2. Global Admin always wins regardless of active Dado
  if (userProfile.role === 'global_admin') return 'global_admin';

  // 3. If the active Dado's adminId matches the current Firebase Auth UID,
  //    the user is the Dado Admin for this Dado
  if (activeDado?.adminId === currentUser?.uid) return 'dado_admin';

  // 4. Look up the user's participation record for the active Dado.
  //    myParticipations is the result of:
  //      query(collection(db, 'users'), where('username', '==', userProfile.username))
  //    Each record carries its own `role` field for that Dado.
  const participation = myParticipations.find((p) => p.dadoId === activeDado?.id);
  if (participation) return participation.role;

  // 5. Fallback — user has no record in this Dado
  return 'jugador';
};

const canModifyPoints = (): boolean => {
  const role = getActiveRole();
  return ['global_admin', 'dado_admin', 'intermediario'].includes(role);
};

const batch = writeBatch(db);

// Record the admin on the Dado
batch.update(doc(db, 'dados', dadoId), {
  adminId: adminUser.id,
  adminEmail: adminUser.email,
  adminName: adminUser.username,
});

// Elevate the user's stored role and tie them to the Dado
batch.update(doc(db, 'users', adminUser.id), {
  role: 'dado_admin',
  dadoId: dadoId,
});

await batch.commit();

// Promote to intermediario
await updateDoc(doc(db, 'users', userId), { role: 'intermediario' });

// Demote back to jugador
await updateDoc(doc(db, 'users', userId), { role: 'jugador' });