import { describe, expect, it } from "vitest";
import {
  ALL_PERMISSIONS,
  ROLE_DEFINITIONS,
  ROLE_KEYS,
  hasPermission,
  isPermission,
  resolveScope,
} from "@/lib/auth/permissions";

const grantedFor = (role: (typeof ROLE_KEYS)[number]) =>
  new Set<string>(ROLE_DEFINITIONS[role].permissions);

describe("matriz de roles", () => {
  it("todo permiso asignado existe en el catálogo y no se repite", () => {
    for (const role of ROLE_KEYS) {
      const perms = ROLE_DEFINITIONS[role].permissions;
      for (const perm of perms) expect(isPermission(perm)).toBe(true);
      expect(new Set(perms).size).toBe(perms.length);
    }
  });

  it("SUPER_ADMIN tiene todos los permisos", () => {
    expect(grantedFor("SUPER_ADMIN").size).toBe(ALL_PERMISSIONS.length);
  });

  it("solo SUPER_ADMIN gestiona administradores y restaura registros", () => {
    for (const role of ["ADMIN", "SUPERVISOR", "ADVISOR"] as const) {
      expect(hasPermission(grantedFor(role), "users.write.admins")).toBe(false);
      expect(hasPermission(grantedFor(role), "records.restore")).toBe(false);
    }
  });

  it("solo ADMIN (y SUPER_ADMIN) anula ventas y modifica la comisión del asesor", () => {
    expect(hasPermission(grantedFor("ADMIN"), "sales.annul")).toBe(true);
    expect(hasPermission(grantedFor("ADMIN"), "sales.commission.override")).toBe(true);
    for (const role of ["SUPERVISOR", "ADVISOR"] as const) {
      expect(hasPermission(grantedFor(role), "sales.annul")).toBe(false);
      expect(hasPermission(grantedFor(role), "sales.commission.override")).toBe(false);
    }
  });

  it("ADVISOR registra ventas de sus leads sin aprobación y solo ve lo suyo", () => {
    const advisor = grantedFor("ADVISOR");
    expect(hasPermission(advisor, "sales.create.own")).toBe(true);
    expect(resolveScope(advisor, "leads.read")).toBe("own");
    expect(resolveScope(advisor, "customers.read")).toBe("own");
    expect(resolveScope(advisor, "appointments.read")).toBe("own");
    expect(resolveScope(advisor, "commissions.read")).toBe("own");
    expect(hasPermission(advisor, "users.read")).toBe(false);
    expect(hasPermission(advisor, "reports.export")).toBe(false);
  });

  it("SUPERVISOR ve todo el CRM y reasigna, pero no gestiona usuarios", () => {
    const supervisor = grantedFor("SUPERVISOR");
    expect(resolveScope(supervisor, "leads.read")).toBe("all");
    expect(hasPermission(supervisor, "leads.assign")).toBe(true);
    expect(hasPermission(supervisor, "users.read")).toBe(false);
    expect(hasPermission(supervisor, "vehicles.write")).toBe(false);
  });

  it("resolveScope devuelve none sin ninguna variante", () => {
    expect(resolveScope(new Set(), "leads.read")).toBe("none");
  });
});