import { describe, expect, it } from "vitest";
import { requirePermission } from "@/modules/auth/rbac";

describe("modules/auth/rbac", () => {
  const adminAuth = {
    type: "admin" as const,
    userId: "ADMIN_001",
    role: "admin" as const,
  };

  const hostAuth = {
    type: "service" as const,
    customerId: "CUST_001",
    permissions: ["pricing:markup:write" as const],
  };

  it("admin + alert:read 通过", () => {
    expect(() => requirePermission(adminAuth, "alert:read")).not.toThrow();
  });

  it("admin + rpa:operate 通过", () => {
    expect(() => requirePermission(adminAuth, "rpa:operate")).not.toThrow();
  });

  it("宿主 token + alert:read 拒绝", () => {
    expect(() => requirePermission(hostAuth, "alert:read")).toThrow(
      expect.objectContaining({ code: "FORBIDDEN" }),
    );
  });

  it("宿主 token + pricing:markup:write 通过", () => {
    expect(() =>
      requirePermission(hostAuth, "pricing:markup:write"),
    ).not.toThrow();
  });
});