chore: establish local platform baseline

internal/identity/permissions_test.go

@@ -0,0 +1,35 @@
+package identity
+
+import "testing"
+
+func TestRoleCapabilityMatrix(t *testing.T) {
+	tests := []struct {
+		role       Role
+		capability Capability
+		allowed    bool
+	}{
+		{RoleOwner, CapabilityMemberManage, true},
+		{RoleAdmin, CapabilityMemberManage, true},
+		{RoleEditor, CapabilityMemberManage, false},
+		{RoleViewer, CapabilitySubjectWrite, false},
+		{RoleViewer, CapabilityConversationRead, true},
+		{RoleAdmin, CapabilityOwnershipTransfer, false},
+		{RoleOwner, CapabilityPrivacyManage, true},
+		{RoleAdmin, CapabilityPrivacyRead, true},
+		{RoleAdmin, CapabilityPrivacyManage, false},
+		{RoleEditor, CapabilityPrivacyRead, false},
+	}
+	for _, test := range tests {
+		if actual := Can(test.role, test.capability); actual != test.allowed {
+			t.Errorf("Can(%s, %s) = %t, want %t", test.role, test.capability, actual, test.allowed)
+		}
+	}
+}
+
+func TestHouseholdRoleNeverGrantsRecordingAccess(t *testing.T) {
+	for _, role := range []Role{RoleOwner, RoleAdmin, RoleEditor, RoleViewer} {
+		if Can(role, CapabilityRecordingPlay) || Can(role, CapabilityRecordingDownload) {
+			t.Fatalf("role %s must not implicitly grant recording access", role)
+		}
+	}
+}