import assert from 'node:assert/strict';

const {
  hasResolvedTenantPermission,
  hasTenantPermission,
} = await import('../apps/api/src/features/tenant-admin/auth.ts');

function auth(role, permissions = {}, templatePermissions = {}) {
  return { role, permissions, templatePermissions };
}

assert.equal(
  hasTenantPermission(auth('teacher'), 'content:questions:write'),
  true,
  'teacher role defaults should grant content permissions',
);
assert.equal(
  hasTenantPermission(auth('teacher', { 'content:*': false }), 'content:questions:write'),
  false,
  'member wildcard deny must override role defaults',
);
assert.equal(
  hasTenantPermission(auth('tenant_operator', { 'content:questions:write': false }), 'content:questions:write'),
  false,
  'member exact deny must override role defaults',
);
assert.equal(
  hasTenantPermission(auth('teacher', { 'content:questions:write': true, 'content:*': false }), 'content:questions:write'),
  true,
  'member exact allow must take precedence over a broader member deny',
);
assert.equal(
  hasTenantPermission(auth('teacher', {}, { 'content:*': false }), 'content:questions:write'),
  false,
  'template wildcard deny must override role defaults',
);
assert.equal(
  hasTenantPermission(auth('teacher', { 'content:*': false }, { 'content:questions:write': true }), 'content:questions:write'),
  false,
  'member decisions must take precedence over template decisions',
);
assert.equal(
  hasResolvedTenantPermission(auth('teacher'), 'content:analytics:read', false),
  false,
  'a caller may narrow role defaults for sensitive content permissions',
);
assert.equal(
  hasResolvedTenantPermission(auth('teacher', { 'content:analytics:read': true }), 'content:analytics:read', false),
  true,
  'an explicit member grant should work when the caller role default is denied',
);
assert.equal(
  hasResolvedTenantPermission(auth('tenant_owner', { 'content:*': false }), 'content:write', true),
  false,
  'explicit deny must apply even to a role that is allowed by default',
);

console.log('[PASS] tenant permission resolution precedence');