package svcrole

import "testing"

// Service is mintable the moment it is in the catalogue: the mint door, the
// mint form and doorsFor all read All(), so nothing else has to change for an
// account owner to issue one.
func TestServiceRoleIsMintable(t *testing.T) {
	got, ok := Parse("service")
	if !ok || got != Service {
		t.Fatalf("Parse(\"service\") = %q, %v", got, ok)
	}

	var found bool
	for _, r := range All() {
		if r == Service {
			found = true
		}
	}
	if !found {
		t.Fatalf("Service is not in All(): %v", All())
	}
}

// A Service door admits Service — and Admin, by construction. Allow adds Admin
// to every set, so this is not a hole to fix but a fact to state: the
// per-app isolation property is about role Service specifically.
func TestServiceDoorAdmitsServiceAndAdmin(t *testing.T) {
	s := Allow(Service)
	if !s.Permits(Service) {
		t.Fatal("a Service door refuses Service")
	}
	if !s.Permits(Admin) {
		t.Fatal("Allow adds Admin to every set; that changed")
	}
	for _, r := range []Role{Publish, Instance, Operate} {
		if s.Permits(r) {
			t.Fatalf("a Service door admits %q", r)
		}
	}
}

// The mirror: adding Service must not widen the roles that already exist. A
// Publish or Instance credential has no business spending deployment CPU.
func TestExistingRolesDoNotReachServiceDoors(t *testing.T) {
	for _, door := range []Set{Allow(Publish), Allow(Instance), Allow(Operate)} {
		if door.Permits(Service) {
			t.Fatalf("%v admits Service", door.Roles())
		}
	}
}