import { describe, it, expect } from 'vitest';
import { OPERATOR_ROLE_DEFINITIONS, OperatorRole } from '../contracts';

describe('Control Center RBAC & Operator Role Matrix', () => {
  const roles: OperatorRole[] = [
    'platform_owner',
    'platform_admin',
    'support_operator',
    'billing_manager',
    'security_auditor',
    'release_manager',
  ];

  it('defines all 6 operator roles in OPERATOR_ROLE_DEFINITIONS', () => {
    roles.forEach((role) => {
      expect(OPERATOR_ROLE_DEFINITIONS[role]).toBeDefined();
      expect(OPERATOR_ROLE_DEFINITIONS[role].label).toBeTruthy();
      expect(OPERATOR_ROLE_DEFINITIONS[role].description).toBeTruthy();
      expect(OPERATOR_ROLE_DEFINITIONS[role].permissions).toBeDefined();
    });
  });

  it('grants platform_owner full capabilities across all domains', () => {
    const p = OPERATOR_ROLE_DEFINITIONS.platform_owner.permissions;
    expect(p.canManagePlatformStatus).toBe(true);
    expect(p.canGrantTrialGrace).toBe(true);
    expect(p.canEditEntitlements).toBe(true);
    expect(p.canTriggerRollouts).toBe(true);
    expect(p.canPauseRollbackRollouts).toBe(true);
    expect(p.canManageIncidents).toBe(true);
    expect(p.canCreateAnnouncements).toBe(true);
    expect(p.canScheduleMaintenance).toBe(true);
    expect(p.canRequestDiagnostics).toBe(true);
    expect(p.canExportAudit).toBe(true);
    expect(p.canViewBillingDetails).toBe(true);
  });

  it('enforces support_operator as diagnostic and incident responder without destructive permissions', () => {
    const p = OPERATOR_ROLE_DEFINITIONS.support_operator.permissions;
    expect(p.canRequestDiagnostics).toBe(true);
    expect(p.canManageIncidents).toBe(true);
    expect(p.canCreateAnnouncements).toBe(true);
    // Denied destructive/commercial
    expect(p.canManagePlatformStatus).toBe(false);
    expect(p.canGrantTrialGrace).toBe(false);
    expect(p.canTriggerRollouts).toBe(false);
    expect(p.canPauseRollbackRollouts).toBe(false);
    expect(p.canEditEntitlements).toBe(false);
  });

  it('restricts billing_manager to financial operations and forbids infrastructure/rollouts', () => {
    const p = OPERATOR_ROLE_DEFINITIONS.billing_manager.permissions;
    expect(p.canViewBillingDetails).toBe(true);
    expect(p.canGrantTrialGrace).toBe(true);
    expect(p.canEditEntitlements).toBe(true);
    // Denied tech/infra
    expect(p.canTriggerRollouts).toBe(false);
    expect(p.canPauseRollbackRollouts).toBe(false);
    expect(p.canScheduleMaintenance).toBe(false);
    expect(p.canRequestDiagnostics).toBe(false);
  });

  it('restricts release_manager to rollout workflows and forbids financial modifications', () => {
    const p = OPERATOR_ROLE_DEFINITIONS.release_manager.permissions;
    expect(p.canTriggerRollouts).toBe(true);
    expect(p.canPauseRollbackRollouts).toBe(true);
    expect(p.canManageIncidents).toBe(true);
    expect(p.canCreateAnnouncements).toBe(true);
    expect(p.canScheduleMaintenance).toBe(false);
    // Denied billing & tenant status
    expect(p.canManagePlatformStatus).toBe(false);
    expect(p.canGrantTrialGrace).toBe(false);
    expect(p.canEditEntitlements).toBe(false);
    expect(p.canViewBillingDetails).toBe(false);
  });

  it('isolates security_auditor to immutable audit inspection without mutation capabilities', () => {
    const p = OPERATOR_ROLE_DEFINITIONS.security_auditor.permissions;
    expect(p.canExportAudit).toBe(true);
    expect(p.canViewBillingDetails).toBe(true);
    // All mutations denied
    expect(p.canManagePlatformStatus).toBe(false);
    expect(p.canGrantTrialGrace).toBe(false);
    expect(p.canEditEntitlements).toBe(false);
    expect(p.canTriggerRollouts).toBe(false);
    expect(p.canPauseRollbackRollouts).toBe(false);
    expect(p.canManageIncidents).toBe(false);
    expect(p.canCreateAnnouncements).toBe(false);
    expect(p.canScheduleMaintenance).toBe(false);
  });
});