package httpx

import (
	"testing"

	"github.com/stretchr/testify/assert"
)

func TestRBACManager_DefaultPermissions(t *testing.T) {
	r := NewRBACManager()

	// 监管拥有全部权限
	assert.True(t, r.HasPermission("regulator", PermContentIssue))
	assert.True(t, r.HasPermission("regulator", PermContentTakedown))
	assert.True(t, r.HasPermission("regulator", PermManageUsers))

	// 审核主体不能发码
	assert.False(t, r.HasPermission("reviewer", PermContentIssue))
	assert.True(t, r.HasPermission("reviewer", PermContentReview))

	// CP 不能下架
	assert.False(t, r.HasPermission("cp", PermContentTakedown))
	assert.True(t, r.HasPermission("cp", PermContentRegister))

	// 运营商不能发码
	assert.False(t, r.HasPermission("operator", PermContentIssue))
	assert.True(t, r.HasPermission("operator", PermContentInject))
}

func TestRBACManager_DynamicConfig(t *testing.T) {
	r := NewRBACManager()

	// 新增自定义角色
	r.SetRolePermissions("auditor", []Permission{
		PermQueryProvenance, PermQueryAccountability, PermQueryEvidence,
	})
	assert.True(t, r.HasPermission("auditor", PermQueryProvenance))
	assert.False(t, r.HasPermission("auditor", PermContentIssue))

	// 动态授权
	r.GrantPermission("auditor", PermContentVerify)
	assert.True(t, r.HasPermission("auditor", PermContentVerify))

	// 撤销权限
	r.RevokePermission("auditor", PermContentVerify)
	assert.False(t, r.HasPermission("auditor", PermContentVerify))

	// 列出角色
	roles := r.ListRoles()
	assert.Contains(t, roles, "regulator")
	assert.Contains(t, roles, "auditor")

	// 列出权限
	perms := r.ListPermissions("auditor")
	assert.Len(t, perms, 3)
}

func TestRBACManager_UnknownRole(t *testing.T) {
	r := NewRBACManager()
	assert.False(t, r.HasPermission("nonexistent", PermContentIssue))
	assert.Empty(t, r.ListPermissions("nonexistent"))
}