package identity

import "testing"

func TestRoleAndDirectPermissionsAreMerged(t *testing.T) {
	account := Account{Role: "auditor", Permissions: []string{PermissionProviderManage}}
	if !HasPermission(account, PermissionProviderRead) || !HasPermission(account, PermissionProviderManage) {
		t.Fatal("expected role and direct permissions to be merged")
	}
	if HasPermission(account, PermissionIdentityManage) {
		t.Fatal("unexpected identity management permission")
	}
}

func TestSuperadminWildcard(t *testing.T) {
	if !HasPermission(Account{Role: "superadmin"}, "future_resource:future_action") {
		t.Fatal("superadmin wildcard must cover future permissions")
	}
}

func TestNormalizePermissions(t *testing.T) {
	permissions, err := normalizePermissions([]string{"provider:read", " provider:read ", "future.feature:execute"})
	if err != nil || len(permissions) != 2 {
		t.Fatalf("unexpected normalized permissions: %#v, %v", permissions, err)
	}
	if _, err := normalizePermissions([]string{"INVALID PERMISSION"}); err == nil {
		t.Fatal("expected invalid permission to be rejected")
	}
}