tatlock-ui/test/core/auth/permission_gate_test.dart

import 'package:flutter_test/flutter_test.dart';
import 'package:tatlock_ui/core/auth/auth_state.dart';
import 'package:tatlock_ui/core/auth/permissions.dart';

// Note: PermissionGate widget tests require complex provider mocking.
// These unit tests verify the permission logic that PermissionGate relies on.
// Widget integration tests should be done with a running app or container testing.

void main() {
  group('PermissionGate logic', () {
    test('hasPermission returns true when role grants permission', () {
      final state = AuthState(
        isAuthenticated: true,
        roles: const [
          Role(
            id: '1',
            name: 'control-room.general:admin',
            domain: Domain.controlRoom,
            category: 'general',
            action: Action.admin,
          ),
        ],
      );

      expect(state.hasPermission(Domain.controlRoom, Action.admin), isTrue);
      expect(state.hasPermission(Domain.controlRoom, Action.viewer), isTrue);
    });

    test('hasPermission returns false when role does not grant permission', () {
      final state = AuthState(
        isAuthenticated: true,
        roles: const [
          Role(
            id: '1',
            name: 'media.general:viewer',
            domain: Domain.media,
            category: 'general',
            action: Action.viewer,
          ),
        ],
      );

      expect(state.hasPermission(Domain.controlRoom, Action.admin), isFalse);
      expect(state.hasPermission(Domain.media, Action.admin), isFalse);
    });

    test('hasPermission returns false when not authenticated', () {
      const state = AuthState(isAuthenticated: false);

      expect(state.hasPermission(Domain.controlRoom, Action.viewer), isFalse);
    });

    test('hasPermission respects category', () {
      final state = AuthState(
        isAuthenticated: true,
        roles: const [
          Role(
            id: '1',
            name: 'control-room.servers:admin',
            domain: Domain.controlRoom,
            category: 'servers',
            action: Action.admin,
          ),
        ],
      );

      expect(
        state.hasPermission(Domain.controlRoom, Action.admin, category: 'servers'),
        isTrue,
      );
      expect(
        state.hasPermission(Domain.controlRoom, Action.admin, category: 'general'),
        isFalse,
      );
    });

    test('isGlobalAdmin returns true for admin.general:admin role', () {
      final state = AuthState(
        isAuthenticated: true,
        roles: const [
          Role(
            id: '1',
            name: 'admin.general:admin',
            domain: Domain.admin,
            category: 'general',
            action: Action.admin,
          ),
        ],
      );

      expect(state.isGlobalAdmin, isTrue);
    });

    test('isGlobalAdmin returns false for non-admin roles', () {
      final state = AuthState(
        isAuthenticated: true,
        roles: const [
          Role(
            id: '1',
            name: 'control-room.general:admin',
            domain: Domain.controlRoom,
            category: 'general',
            action: Action.admin,
          ),
        ],
      );

      expect(state.isGlobalAdmin, isFalse);
    });

    test('global admin has access to all domains', () {
      final state = AuthState(
        isAuthenticated: true,
        roles: const [
          Role(
            id: '1',
            name: 'admin.general:admin',
            domain: Domain.admin,
            category: 'general',
            action: Action.admin,
          ),
        ],
      );

      // Global admin should have access to everything
      expect(state.hasPermission(Domain.controlRoom, Action.admin), isTrue);
      expect(state.hasPermission(Domain.media, Action.editor), isTrue);
      expect(state.hasPermission(Domain.library, Action.viewer), isTrue);
      expect(
        state.hasPermission(Domain.documents, Action.user, category: 'custom'),
        isTrue,
      );
    });

    test('empty roles list denies all permissions', () {
      const state = AuthState(isAuthenticated: true, roles: []);

      expect(state.hasPermission(Domain.controlRoom, Action.viewer), isFalse);
      expect(state.isGlobalAdmin, isFalse);
    });

    test('multiple roles are evaluated correctly', () {
      final state = AuthState(
        isAuthenticated: true,
        roles: const [
          Role(
            id: '1',
            name: 'media.general:viewer',
            domain: Domain.media,
            category: 'general',
            action: Action.viewer,
          ),
          Role(
            id: '2',
            name: 'control-room.general:admin',
            domain: Domain.controlRoom,
            category: 'general',
            action: Action.admin,
          ),
        ],
      );

      // Should have permissions from both roles
      expect(state.hasPermission(Domain.media, Action.viewer), isTrue);
      expect(state.hasPermission(Domain.controlRoom, Action.admin), isTrue);

      // But not permissions not granted by any role
      expect(state.hasPermission(Domain.media, Action.admin), isFalse);
      expect(state.hasPermission(Domain.library, Action.viewer), isFalse);
    });
  });
}