import { describe, expect, it } from "vitest";
import { can } from "../src/rbac";

describe("can", () => {
  it("allows every role to read the dashboard", () => {
    expect(can(["viewer"], "dashboard.read")).toBe(true);
    expect(can(["auditor"], "dashboard.read")).toBe(true);
    expect(can(["operator"], "dashboard.read")).toBe(true);
    expect(can(["admin"], "dashboard.read")).toBe(true);
  });

  it("denies audit.read to a viewer but allows it for auditor and above", () => {
    expect(can(["viewer"], "audit.read")).toBe(false);
    expect(can(["auditor"], "audit.read")).toBe(true);
    expect(can(["operator"], "audit.read")).toBe(true);
    expect(can(["admin"], "audit.read")).toBe(true);
  });

  it("restricts client.disable and client.revoke to operator and admin", () => {
    expect(can(["viewer"], "client.disable")).toBe(false);
    expect(can(["auditor"], "client.disable")).toBe(false);
    expect(can(["operator"], "client.disable")).toBe(true);
    expect(can(["admin"], "client.disable")).toBe(true);
    expect(can(["operator"], "client.revoke")).toBe(true);
    expect(can(["viewer"], "client.revoke")).toBe(false);
  });

  it("restricts live tool readiness checks to operator and admin", () => {
    expect(can(["viewer"], "tool.test")).toBe(false);
    expect(can(["auditor"], "tool.test")).toBe(false);
    expect(can(["operator"], "tool.test")).toBe(true);
    expect(can(["admin"], "tool.test")).toBe(true);
  });

  it("restricts actual tool invocation and operational probes to operator and admin", () => {
    for (const action of ["tool.invoke", "operations.check"] as const) {
      expect(can(["viewer"], action)).toBe(false);
      expect(can(["auditor"], action)).toBe(false);
      expect(can(["operator"], action)).toBe(true);
      expect(can(["admin"], action)).toBe(true);
    }
  });

  it("restricts client.create and catalog.apply to admin only", () => {
    expect(can(["operator"], "client.create")).toBe(false);
    expect(can(["admin"], "client.create")).toBe(true);
    expect(can(["operator"], "catalog.apply")).toBe(false);
    expect(can(["admin"], "catalog.apply")).toBe(true);
  });

  it("allows policy.simulate and catalog.preview for every role, side-effect-free reads", () => {
    expect(can(["viewer"], "policy.simulate")).toBe(true);
    expect(can(["viewer"], "catalog.preview")).toBe(true);
  });

  it("returns false for an empty role list, never throws", () => {
    expect(can([], "dashboard.read")).toBe(false);
  });

  it("is permissive if the principal holds any one sufficient role among several", () => {
    expect(can(["viewer", "admin"], "client.create")).toBe(true);
  });
});