package security

import "testing"

// TestSuperuserHoldsEveryToolByRule is amendment 6 decision 12. The tenant top seat holds every product
// tool its tenant is entitled to BY RULE, not by grant, so the entitlement grid can never render the top
// seat as broken. This is the exact defect the design partner hit: a superuser with zero grants saw every
// control locked.
func TestSuperuserHoldsEveryToolByRule(t *testing.T) {
	got := EffectiveTools(RoleSuperuser, nil)
	if len(got) != len(AllTools) {
		t.Fatalf("a tenant superuser must hold every tool by rule, got %v", got)
	}
	for _, want := range AllTools {
		if !HasTool(got, want) {
			t.Errorf("superuser is missing %s, which by rule it must hold", want)
		}
	}
}

// TestOperatorHoldsEveryToolEverywhere covers the platform plane: operator holds all tools in every tenant.
func TestOperatorHoldsEveryToolEverywhere(t *testing.T) {
	got := EffectiveTools(RoleOperator, []string{})
	for _, want := range AllTools {
		if !HasTool(got, want) {
			t.Errorf("operator is missing %s, which by rule it must hold everywhere", want)
		}
	}
}

// TestRolesBelowSuperuserKeepGrantedToolsOnly is the other half of decision 12: confer only what you hold
// stands unchanged for every role BELOW superuser, where it is load bearing. A grant driven role must NOT
// gain tools by rule, or the ceiling on spreading access disappears.
func TestRolesBelowSuperuserKeepGrantedToolsOnly(t *testing.T) {
	for _, role := range []Role{RoleOwner, RoleAdmin, RoleManager, RoleRecruiter, RoleMember, RoleViewer} {
		got := EffectiveTools(role, []string{string(ToolMissionMatch)})
		if len(got) != 1 || !HasTool(got, ToolMissionMatch) {
			t.Errorf("%s must hold exactly its granted tools, got %v", role, got)
		}
		if HasTool(got, ToolRecruitMatch) {
			t.Errorf("%s gained an ungranted tool, the confer ceiling is broken", role)
		}
	}
}

// TestEffectiveToolsPreservesAGrantedSetForTheTopSeat proves the by rule set is a superset, never a
// replacement that could DROP a tool an account legitimately holds.
func TestEffectiveToolsPreservesAGrantedSetForTheTopSeat(t *testing.T) {
	got := EffectiveTools(RoleSuperuser, []string{string(ToolMissionMatch)})
	for _, want := range AllTools {
		if !HasTool(got, want) {
			t.Errorf("by rule resolution dropped %s", want)
		}
	}
}

// TestDisabledReasonIsNeverSilent is amendment 6 decision 13. A disabled entitlement control must state
// WHICH reason applies, and the two are distinct: the organization is not entitled, or the actor does not
// personally hold the tool. An empty reason is the bug that made the product look broken.
func TestDisabledReasonIsNeverSilent(t *testing.T) {
	// The actor holds missionmatch; the org is entitled to missionmatch and recruitmatch.
	orgEntitled := []string{string(ToolMissionMatch), string(ToolRecruitMatch)}
	actorHolds := []string{string(ToolMissionMatch)}

	if r := ToolDisabledReason(ToolMissionMatch, orgEntitled, actorHolds); r != "" {
		t.Errorf("a tool the actor holds must not be disabled, got reason %q", r)
	}
	if r := ToolDisabledReason(ToolRecruitMatch, orgEntitled, actorHolds); r != ReasonActorLacksTool {
		t.Errorf("expected the actor lacks tool reason, got %q", r)
	}
	if r := ToolDisabledReason(ToolSlateMatch, orgEntitled, actorHolds); r != ReasonOrgNotEntitled {
		t.Errorf("expected the org not entitled reason, got %q", r)
	}
	// Neither reason may ever be the empty string, which is what silent grey looks like.
	for _, reason := range []string{ReasonOrgNotEntitled, ReasonActorLacksTool} {
		if reason == "" {
			t.Error("a disabled reason is empty, which is the silent grey this decision forbids")
		}
	}
}