save first version

internal/tickets/auth_test.go

@@ -0,0 +1,95 @@
+package tickets
+
+import (
+	"testing"
+
+	"github.com/leolionad58/ticketbot/internal/config"
+	"github.com/leolionad58/ticketbot/internal/db"
+)
+
+func makeProvider() *config.Provider {
+	cfg := &config.Config{
+		Bot: config.Bot{AdminRole: "admin-role"},
+		Panels: map[string]config.Panel{
+			"support_panel": {
+				Types: map[string]config.TicketType{
+					"support": {StaffRole: "staff-role"},
+					"mod":     {StaffRole: "mod-role"},
+				},
+			},
+		},
+	}
+	return config.NewProvider(cfg)
+}
+
+func supportTicket() *db.Ticket {
+	return &db.Ticket{Panel: "support_panel", Type: "support"}
+}
+
+func TestCanAdmin(t *testing.T) {
+	auth := NewAuthService(makeProvider())
+	if !auth.Can([]string{"admin-role"}, ActionAdmin, nil) {
+		t.Error("admin should pass ActionAdmin")
+	}
+	if auth.Can([]string{"random"}, ActionAdmin, nil) {
+		t.Error("non-admin should fail ActionAdmin")
+	}
+}
+
+func TestCanClaim(t *testing.T) {
+	auth := NewAuthService(makeProvider())
+	ticket := supportTicket()
+	if !auth.Can([]string{"staff-role"}, ActionClaim, ticket) {
+		t.Error("staff should claim")
+	}
+	if !auth.Can([]string{"admin-role"}, ActionClaim, ticket) {
+		t.Error("admin should claim")
+	}
+	if auth.Can([]string{"mod-role"}, ActionClaim, ticket) {
+		t.Error("wrong-staff should not claim support ticket")
+	}
+	if auth.Can([]string{"random"}, ActionClaim, ticket) {
+		t.Error("non-staff should not claim")
+	}
+}
+
+func TestCanTicketActions(t *testing.T) {
+	auth := NewAuthService(makeProvider())
+	ticket := supportTicket()
+	for _, action := range []Action{ActionClose, ActionAdd, ActionRemove, ActionRename, ActionTranscript} {
+		if !auth.Can([]string{"staff-role"}, action, ticket) {
+			t.Errorf("staff should be able to action %d", action)
+		}
+		if !auth.Can([]string{"admin-role"}, action, ticket) {
+			t.Errorf("admin should be able to action %d", action)
+		}
+		if auth.Can([]string{"random"}, action, ticket) {
+			t.Errorf("random should not be able to action %d", action)
+		}
+	}
+}
+
+func TestCanConvocation(t *testing.T) {
+	auth := NewAuthService(makeProvider())
+	// any staff role across all panels
+	if !auth.Can([]string{"staff-role"}, ActionConvocation, nil) {
+		t.Error("support staff should convocation")
+	}
+	if !auth.Can([]string{"mod-role"}, ActionConvocation, nil) {
+		t.Error("mod staff should convocation")
+	}
+	if !auth.Can([]string{"admin-role"}, ActionConvocation, nil) {
+		t.Error("admin should convocation")
+	}
+	if auth.Can([]string{"random"}, ActionConvocation, nil) {
+		t.Error("non-staff should not convocation")
+	}
+}
+
+func TestCanNilTicket(t *testing.T) {
+	auth := NewAuthService(makeProvider())
+	// Should not panic and should return false for staff actions without ticket
+	if auth.Can([]string{"staff-role"}, ActionClaim, nil) {
+		t.Error("should not claim nil ticket")
+	}
+}