import test from 'brittle'
import { Roles, roleAllows, MethodRoles } from '../shared/protocol.js'
import { assertAllowed, maxRole } from '../server/core/acl.js'

test('assertAllowed denies viewer mutating ops', (t) => {
  t.exception(() => assertAllowed(Roles.viewer, 'runJob'))
  t.exception(() => assertAllowed(Roles.viewer, 'mintInvite'))
  assertAllowed(Roles.operator, 'runJob')
  assertAllowed(Roles.operator, 'setAlertConfig')
  assertAllowed(Roles.admin, 'mintInvite')
  t.pass()
})

test('maxRole elevates', (t) => {
  t.is(maxRole(Roles.viewer, Roles.operator), Roles.operator)
  t.is(maxRole(Roles.admin, Roles.operator), Roles.admin)
})

test('viewer can read metrics', (t) => {
  t.ok(roleAllows(Roles.viewer, MethodRoles.queryData))
  t.ok(roleAllows(Roles.viewer, MethodRoles.listCharts))
  t.ok(roleAllows(Roles.viewer, MethodRoles.handshake))
  t.ok(roleAllows(Roles.viewer, MethodRoles.subscribeMetrics))
})