import { describe, it, expect } from "vitest";
import { ROLES, ALL_ROLES, isRole, canAccessBrigade } from "../roles";

describe("roles", () => {
  it("definiert die drei Rollen als Single Source of Truth", () => {
    expect(ROLES).toEqual({
      PLATFORM_ADMIN: "platform_admin",
      WEHR_ADMIN: "wehr_admin",
      WEHR_READ: "wehr_read",
    });
    expect(ALL_ROLES).toEqual(["platform_admin", "wehr_admin", "wehr_read"]);
  });

  it("isRole erkennt gültige Rollen", () => {
    expect(isRole("platform_admin")).toBe(true);
    expect(isRole("wehr_admin")).toBe(true);
    expect(isRole("wehr_read")).toBe(true);
    expect(isRole("root")).toBe(false);
    expect(isRole(undefined)).toBe(false);
  });

  describe("canAccessBrigade (Wehr-Scoping)", () => {
    it("platform_admin darf jede Wehr", () => {
      expect(
        canAccessBrigade("platform_admin", null, "wehr-b"),
      ).toBe(true);
    });
    it("wehr_admin darf nur die eigene Wehr", () => {
      expect(canAccessBrigade("wehr_admin", "wehr-a", "wehr-a")).toBe(true);
      expect(canAccessBrigade("wehr_admin", "wehr-a", "wehr-b")).toBe(false);
    });
    it("wehr_read darf nur die eigene Wehr", () => {
      expect(canAccessBrigade("wehr_read", "wehr-a", "wehr-a")).toBe(true);
      expect(canAccessBrigade("wehr_read", "wehr-a", "wehr-b")).toBe(false);
    });
    it("ohne brigadeId verweigert (default-deny)", () => {
      expect(canAccessBrigade("wehr_admin", null, "wehr-a")).toBe(false);
    });
  });
});
