<?php
declare(strict_types=1);
namespace App\Tests;
use App\Security\SiteScope;
use PHPUnit\Framework\TestCase;

final class SiteScopeTest extends TestCase
{
    public function testNullScopeIsGlobal(): void
    {
        $this->assertTrue(SiteScope::isGlobal(null));
        $this->assertTrue(SiteScope::allows(null, 'factory-a'));   // a global operator sees every site
        $this->assertTrue(SiteScope::allows(null, null));
    }

    public function testEmptyStringScopeIsNotGlobal(): void
    {
        // A blank scope (an accidental '') must fail CLOSED — never be silently promoted to
        // global access the way it was before this fix.
        $this->assertFalse(SiteScope::isGlobal(''));
        $this->assertFalse(SiteScope::allows('', 'factory-a'));
        $this->assertFalse(SiteScope::allows('', null));
    }

    public function testScopedCallerSeesOnlyItsExactSite(): void
    {
        $this->assertTrue(SiteScope::allows('factory-a', 'factory-a'));
        $this->assertFalse(SiteScope::allows('factory-a', 'factory-b'));
        $this->assertFalse(SiteScope::allows('factory-a', null));  // an unscoped row is hidden from a scoped caller
    }
}