using Omika.Diagnostics.Security;

namespace Omika.Diagnostics.Tests;

/// <summary>
/// T23 — Matrice d'autorisation finale (Support / Admin), au niveau des règles pures.
/// Les conventions ASP.NET (Program.cs) appliquent : dossier "/" → DiagnosticsSupport ;
/// /System, /Clients, /Users → DiagnosticsAdmin. Ici on vérifie la logique de rôle.
/// </summary>
public class DiagnosticAuthorizationMatrixTests
{
    private static readonly string[] SupportOnly = [DiagnosticRoles.Support];
    private static readonly string[] AdminOnly = [DiagnosticRoles.Admin];

    [Theory]
    [InlineData("Dashboard")]
    [InlineData("Diagnostics")]
    [InlineData("Erreurs")]
    [InlineData("Traces")]
    [InlineData("Synchronisation")]
    [InlineData("Telemetry")]
    [InlineData("Parc")]
    [InlineData("Versions")]
    [InlineData("Referentiel")]
    public void SupportPages_AccessibleToSupportAndAdmin(string _)
    {
        Assert.True(DiagnosticAuthorization.IsSupport(SupportOnly));
        Assert.True(DiagnosticAuthorization.IsSupport(AdminOnly));
    }

    [Theory]
    [InlineData("System")]
    [InlineData("Clients")]
    [InlineData("Users")]
    public void AdminPages_AdminOnly(string _)
    {
        // Admin : accès.
        Assert.True(DiagnosticAuthorization.IsAdmin(AdminOnly));
        // Support seul : refus.
        Assert.False(DiagnosticAuthorization.IsAdmin(SupportOnly));
        // Mais un Support reste un Support (accès aux pages de consultation).
        Assert.True(DiagnosticAuthorization.IsSupport(SupportOnly));
    }

    [Fact]
    public void Admin_KeepsSupportRights()
    {
        // §18 : un Admin doit conserver l'accès Support (IsSupport(Admin) == true).
        Assert.True(DiagnosticAuthorization.IsSupport(AdminOnly));
    }
}