import { readFileSync } from "node:fs";
import { describe, expect, it } from "vitest";

describe("ACL management contract", () => {
	it("uses normalized ACL persistence and the permissions.manage guard", () => {
		const wrapper = readFileSync("src/actions/permissions.ts", "utf8");
		const service = readFileSync(
			"src/features/housekeeping/domains/system/services/mutations.ts",
			"utf8",
		);
		expect(wrapper).toContain("PERMS.PERMISSIONS_MANAGE");
		expect(wrapper).toContain("adminAction");
		expect(wrapper).toContain("access.permissions.update");
		expect(wrapper).toContain("access.permissions.repair");
		expect(service).toContain('import "server-only"');
		expect(service).toContain("AclModelPermission");
		expect(service).not.toContain(
			"export const systemProductionMutationAdapter",
		);
		expect(service).not.toContain("legacyMessage");
		expect(service).not.toContain("websiteHousekeepingPermissions");
		expect(service).not.toContain("websiteTeams");
	});

	it("ships an idempotent ACL completion migration", () => {
		const sql = readFileSync(
			"drizzle/migrations/0014_complete_acl_and_import_permissions.sql",
			"utf8",
		);
		expect(sql).toContain("admin.assets.import");
		expect(sql).toContain("rank_");
		expect(sql).toContain("'Role'");
		expect(sql).toContain("'User'");
	});
});