- "Discover" button (Discovery)
- "Find Contact" button (Headhunt)
- "Save as Lead" button
- "New Interaction" / "New Task" buttons
- "Feedback" buttons
- Scraper page (hidden from sidebar)
- Batch Operations (hidden from sidebar)
- Delete buttons (lead, company, contact)
- Export buttons

- Org Settings (hidden from sidebar)
- Billing (hidden from sidebar)
- Member management
- Batch Operations (hidden from sidebar)
- Delete buttons (company, contact — can delete their own leads)

- Org Settings access (visible in sidebar)
- Invite/remove member buttons
- Segment management (admin level)

- Billing / Plan management
- Delete org button (danger zone)
- Ownership transfer

- /admin/* pages (separate section in sidebar)
- Cross-org navigation
- Platform metrics
- View all users/orgs

// Minimum role check — added to config
export const DELETE = createHandler({
  auth: true,
  requiredRole: 'admin', // minimum admin role required
  logAction: 'lead.deleted',
}, async (request, session) => {
  // session.orgRole already available — createHandler checks it
});

// Button visibility — from useAuth hook
const { activeOrgId, orgRole } = useAuth();
// orgRole not yet available client-side — to be added (AUTH-10 extension)

// Example: hide for viewer
{orgRole !== 'viewer' && <Button>Discover</Button>}

// Example: show for admin+
{['owner', 'admin'].includes(orgRole) && <Button>Invite Member</Button>}

/admin/* → platformRole === 'super_admin' required
/org/billing → orgRole === 'owner' required
/org/settings → orgRole === 'admin' || orgRole === 'owner' required

-- Permission definitions (seed data — super_admin can add more)
export_ai_permission_definitions
  id UUID PK DEFAULT gen_random_uuid()
  key TEXT UNIQUE NOT NULL        -- 'page.discovery', 'action.lead.create'
  category TEXT NOT NULL          -- 'page' | 'action' | 'admin' | 'data'
  label TEXT NOT NULL             -- 'Discovery Page'
  description TEXT                -- 'Permission to run AI-powered company search'
  sort_order INT DEFAULT 0
  created_at TIMESTAMPTZ DEFAULT now()

-- Role-permission mapping (super_admin toggles)
export_ai_role_permissions
  id UUID PK DEFAULT gen_random_uuid()
  role TEXT NOT NULL CHECK(role IN ('owner','admin','member','viewer'))
  permission_key TEXT NOT NULL REFERENCES export_ai_permission_definitions(key)
  allowed BOOLEAN DEFAULT false
  updated_by UUID REFERENCES auth.users  -- who changed it
  updated_at TIMESTAMPTZ DEFAULT now()
  UNIQUE(role, permission_key)

page.discovery          — Access to Discovery page
page.scraper            — Access to Scraper page
page.operations         — Access to Batch Operations page
page.org_settings       — Access to Org Settings page
page.org_billing        — Access to Billing page
action.discovery.run    — Run Discovery (consumes credits)
action.headhunt.run     — Run Headhunt (consumes credits)
action.lead.create      — Create lead
action.lead.delete      — Delete lead
action.company.delete   — Delete company
action.contact.delete   — Delete contact
action.scraper.upload   — Scraper upload
action.batch.run        — Start batch operation
action.export.csv       — CSV/Excel export
admin.members.invite    — Invite member
admin.members.remove    — Remove member
admin.members.role      — Change role
admin.billing.manage    — Manage plan/payment
admin.org.delete        — Delete org
admin.org.transfer      — Ownership transfer

┌────────────────────────────────────────────────────────────────┐
│  Permission Management                              [Save]     │
├────────────────────────────────────────────────────────────────┤
│                         owner  admin  member  viewer           │
│  ─── Pages ────────────────────────────────────────────────    │
│  Discovery               ✅     ✅      ✅      ❌            │
│  Scraper                 ✅     ✅      ☐       ❌            │
│  Batch Operations        ✅     ✅      ❌      ❌            │
│  Org Settings            ✅     ✅      ❌      ❌            │
│  Billing                 ✅     ❌      ❌      ❌            │
│  ─── Actions ──────────────────────────────────────────────    │
│  Run Discovery           ✅     ✅      ✅      ❌            │
│  Create Lead             ✅     ✅      ✅      ❌            │
│  Delete Lead             ✅     ✅      ❌      ❌            │
│  Batch Operation         ✅     ✅      ❌      ❌            │
│  CSV Export              ✅     ✅      ✅      ❌            │
│  ─── Management ───────────────────────────────────────────    │
│  Invite Member           ✅     ✅      ❌      ❌            │
│  Manage Billing          ✅     ❌      ❌      ❌            │
│  Delete Org              ✅     ❌      ❌      ❌            │
└────────────────────────────────────────────────────────────────┘

1. User logs in
2. useAuth → fetches role from organization_members
3. checkPermission(role, 'action.discovery.run') → DB lookup (cached)
4. UI: button visible if permitted, hidden otherwise
5. API: createHandler requiredPermission check
6. If super_admin toggles from /admin/permissions:
   → DB updated
   → Cache invalidated
   → New permission applies on next request

- Permission table is small (~80 rows: 20 permissions x 4 roles)
- Server-side: load into memory at startup, refresh with 5 min TTL
- Client-side: fetch with useAuth, keep in context
- When super_admin makes changes: cache bust endpoint (POST /api/admin/permissions/invalidate)