1 files changed, 39 insertions, 0 deletions
diff --git a/internal/controlplane/access_test.go b/internal/controlplane/access_test.go
new file mode 100644
index 0000000..96e3869
--- /dev/null
+++ b/internal/controlplane/access_test.go
@@ -0,0 +1,39 @@
+package controlplane
+
+import "testing"
+
+func TestConsoleRolePermissions(t *testing.T) {
+	tests := []struct {
+		role, permission string
+		want             bool
+	}{
+		{RolePlatformAdmin, "platform.write", true},
+		{RolePlatformViewer, "platform.read", true},
+		{RolePlatformViewer, "platform.write", false},
+		{RoleTenantAdmin, "keys.write", true},
+		{RoleTenantAdmin, "limits.write", false},
+		{RoleTenantBilling, "billing.topup", true},
+		{RoleTenantBilling, "keys.read", false},
+		{RoleTenantDeveloper, "keys.write", true},
+		{RoleTenantDeveloper, "billing.read", false},
+		{RoleTenantViewer, "usage.read", true},
+		{RoleTenantViewer, "users.read", false},
+	}
+	for _, test := range tests {
+		t.Run(test.role+"/"+test.permission, func(t *testing.T) {
+			if got := (ConsoleActor{Role: test.role}).Can(test.permission); got != test.want {
+				t.Fatalf("Can(%q) = %v, want %v", test.permission, got, test.want)
+			}
+		})
+	}
+}
+
+func TestTenantRoleNeverGetsPlatformPermissions(t *testing.T) {
+	roles := []string{RoleTenantAdmin, RoleTenantBilling, RoleTenantDeveloper, RoleTenantViewer}
+	for _, role := range roles {
+		actor := ConsoleActor{Role: role}
+		if actor.Can("platform.read") || actor.Can("platform.write") {
+			t.Fatalf("role %s received platform access", role)
+		}
+	}
+}