package accesscontrol

import (
	"context"
	"slices"
	"testing"

	"github.com/Tencent/WeKnora/internal/accesspolicy"
	"github.com/Tencent/WeKnora/internal/types"
)

func TestVisiblePermissionsRespectNativeRole(t *testing.T) {
	for _, role := range []types.TenantRole{types.TenantRoleViewer, types.TenantRoleContributor, types.TenantRoleAdmin} {
		ctx := context.WithValue(context.Background(), types.TenantRoleContextKey, role)
		permissions := visiblePermissions(ctx, &accesspolicy.Snapshot{})
		if slices.Contains(permissions, "content.write") != role.HasPermission(types.TenantRoleContributor) {
			t.Fatalf("content mutation visibility does not match native role %s", role)
		}
		if slices.Contains(permissions, "content.review") != role.HasPermission(types.TenantRoleContributor) {
			t.Fatalf("content review visibility does not match native role %s", role)
		}
		if !slices.Contains(permissions, "content.deliver") {
			t.Fatalf("delivery must be available to native readers: %s", role)
		}
		for _, permission := range []string{"access.read", "settings.read", "settings.write", "balance.read", "balance.write", "usage.read", "audit.read", "system.read"} {
			if slices.Contains(permissions, permission) != role.HasPermission(types.TenantRoleAdmin) {
				t.Fatalf("%s visibility does not match native role %s", permission, role)
			}
		}
		if !slices.Contains(permissions, "chat.write") {
			t.Fatalf("native viewer conversation permission must remain available for %s", role)
		}
	}
	ctx := context.WithValue(context.Background(), types.TenantRoleContextKey, types.TenantRoleContributor)
	permissions := visiblePermissions(ctx, &accesspolicy.Snapshot{Restricted: true, Permissions: map[string]bool{"content.read": true}})
	if !slices.Equal(permissions, []string{"content.read"}) {
		t.Fatalf("custom role broadened: %v", permissions)
	}
}