// One policy for the administrative and operational gateways. Legacy admin means
// company operations manager, never cross-company super administrator.
function adminRoleSnapshot(current) {
  const read = key => typeof current.get === 'function' ? current.get(key) : current[key];
  const roles = Array.isArray(read('roles')) ? read('roles').map(String) : [];
  const key = String(read('adminRoleKey') || '');
  const valid = ['super-admin','ops-manager','ops-staff','ops-auditor'];
  let role = valid.includes(key) ? key : valid.find(value => roles.includes(value)) || '';
  const legacy = read('isAdmin') === true || read('role') === 'admin' || roles.includes('admin');
  if (!role && !key && !roles.some(value => value.startsWith('ops-')) && legacy) role = 'ops-manager';
  return {roles:role ? [...new Set([...roles.filter(value=>!valid.includes(value)),role])] : roles,isSuperAdmin:role==='super-admin',operationsRole:role==='super-admin'?'ops-manager':role||'denied',roleKey:role,legacyRole:role==='ops-manager'&&!key&&!roles.some(value=>valid.includes(value)),isAdmin:Boolean(role)||legacy};
}