// SPDX-License-Identifier: MIT
pragma solidity ^0.8.30;

/// @title Roles
/// @notice Central definitions of the AccessControl role identifiers used across Amish
///         contracts. Keeping them in one place avoids typos and gives auditors a single
///         surface for the privilege model. `DEFAULT_ADMIN_ROLE` (0x00, from OZ AccessControl)
///         is the admin of every role below and is what grants/revokes them.
/// @dev Roles are per-contract in AccessControl: granting a role on one contract does not grant
///      it on another. Additional roles (e.g. executor, pauser) are added here as the contracts
///      that need them are built.
library Roles {
    /// @notice May configure per-token fees and the treasury on FeeRegistry.
    bytes32 internal constant FEE_MANAGER_ROLE = keccak256("FEE_MANAGER_ROLE");

    /// @notice May tune the global liquidation risk parameters on LoanManager (bonus curve, auction
    ///         duration, grace periods, restore buffer). Every value is range-bounded in code, so this
    ///         role can adjust the auction's shape but cannot make an otherwise-healthy loan seizable.
    bytes32 internal constant RISK_MANAGER_ROLE = keccak256("RISK_MANAGER_ROLE");

    /// @notice May authorize UUPS implementation upgrades on any upgradeable Amish singleton.
    ///         Held by a Timelock in production.
    bytes32 internal constant UPGRADER_ROLE = keccak256("UPGRADER_ROLE");

    /// @notice May submit matched intents to AmishHub for execution. Team-operated and rotatable;
    ///         a policy gate for best-execution, not a safety mechanism (the Hub verifies everything).
    bytes32 internal constant EXECUTOR_ROLE = keccak256("EXECUTOR_ROLE");

    /// @notice May list new price routes on ChainlinkOracle and propose/execute/cancel timelocked
    ///         updates to existing ones. Listing a new pair is immediate (nothing depends on it yet);
    ///         changing a live pair's route is delayed by the contract's built-in timelock, so this
    ///         role can never reprice existing loans without notice.
    bytes32 internal constant ORACLE_MANAGER_ROLE = keccak256("ORACLE_MANAGER_ROLE");
}