<?php
declare(strict_types=1);
namespace App\Tests;
use App\Auth\Rbac;
use PHPUnit\Framework\TestCase;

final class RbacTest extends TestCase
{
    public function testViewerCanOnlyView(): void {
        $this->assertTrue(Rbac::can('viewer', 'view_events'));
        $this->assertFalse(Rbac::can('viewer', 'acknowledge'));
        $this->assertFalse(Rbac::can('viewer', 'edit_zones'));
    }
    public function testOperator(): void {
        $this->assertTrue(Rbac::can('operator', 'acknowledge'));
        $this->assertTrue(Rbac::can('operator', 'edit_zones'));
        $this->assertFalse(Rbac::can('operator', 'manage_thresholds'));
    }
    public function testAdminAll(): void {
        foreach (['view_events','acknowledge','edit_zones','manage_thresholds','manage_compliance'] as $p) {
            $this->assertTrue(Rbac::can('admin', $p));
        }
    }
    public function testUnknownDenied(): void {
        $this->assertFalse(Rbac::can('ghost', 'view_events'));
        $this->assertFalse(Rbac::can('admin', 'unknown_perm'));
    }
}