package identity

import "testing"

func TestRoleCapabilityMatrix(t *testing.T) {
	tests := []struct {
		role       Role
		capability Capability
		allowed    bool
	}{
		{RoleOwner, CapabilityMemberManage, true},
		{RoleAdmin, CapabilityMemberManage, true},
		{RoleEditor, CapabilityMemberManage, false},
		{RoleViewer, CapabilitySubjectWrite, false},
		{RoleViewer, CapabilityConversationRead, true},
		{RoleAdmin, CapabilityOwnershipTransfer, false},
		{RoleOwner, CapabilityPrivacyManage, true},
		{RoleAdmin, CapabilityPrivacyRead, true},
		{RoleAdmin, CapabilityPrivacyManage, false},
		{RoleEditor, CapabilityPrivacyRead, false},
	}
	for _, test := range tests {
		if actual := Can(test.role, test.capability); actual != test.allowed {
			t.Errorf("Can(%s, %s) = %t, want %t", test.role, test.capability, actual, test.allowed)
		}
	}
}

func TestHouseholdRoleNeverGrantsRecordingAccess(t *testing.T) {
	for _, role := range []Role{RoleOwner, RoleAdmin, RoleEditor, RoleViewer} {
		if Can(role, CapabilityRecordingPlay) || Can(role, CapabilityRecordingDownload) {
			t.Fatalf("role %s must not implicitly grant recording access", role)
		}
	}
}