package controlplane

import "testing"

func TestConsoleRolePermissions(t *testing.T) {
	tests := []struct {
		role, permission string
		want             bool
	}{
		{RolePlatformAdmin, "platform.write", true},
		{RolePlatformViewer, "platform.read", true},
		{RolePlatformViewer, "platform.write", false},
		{RoleTenantAdmin, "keys.write", true},
		{RoleTenantAdmin, "limits.write", false},
		{RoleTenantBilling, "billing.topup", true},
		{RoleTenantBilling, "keys.read", false},
		{RoleTenantDeveloper, "keys.write", true},
		{RoleTenantDeveloper, "billing.read", false},
		{RoleTenantViewer, "usage.read", true},
		{RoleTenantViewer, "users.read", false},
	}
	for _, test := range tests {
		t.Run(test.role+"/"+test.permission, func(t *testing.T) {
			if got := (ConsoleActor{Role: test.role}).Can(test.permission); got != test.want {
				t.Fatalf("Can(%q) = %v, want %v", test.permission, got, test.want)
			}
		})
	}
}

func TestTenantRoleNeverGetsPlatformPermissions(t *testing.T) {
	roles := []string{RoleTenantAdmin, RoleTenantBilling, RoleTenantDeveloper, RoleTenantViewer}
	for _, role := range roles {
		actor := ConsoleActor{Role: role}
		if actor.Can("platform.read") || actor.Can("platform.write") {
			t.Fatalf("role %s received platform access", role)
		}
	}
}