"""Tests for permission semantics reused by page and action guards."""

from doctor_workstation.core.permissions import PermissionSet


def test_global_wildcard_grants_every_page_and_action() -> None:
    """The server's global wildcard remains authoritative."""

    permissions = PermissionSet(["*"])

    assert permissions.is_superuser
    assert permissions.can_access_page("doctor.appointment/lists")
    assert permissions.can_perform_action("doctor.appointment/complete")
    assert permissions.can("doctor.appointment", "complete")


def test_all_and_any_accept_sequences_or_positional_values() -> None:
    """AND and OR helpers preserve the two web-client permission semantics."""

    permissions = PermissionSet(["doctor.appointment/lists", "doctor.appointment/complete"])

    assert permissions.all("doctor.appointment/lists", "doctor.appointment/complete")
    assert permissions.has_all(["doctor.appointment/lists", "doctor.appointment/complete"])
    assert not permissions.all("doctor.appointment/lists", "doctor.appointment/cancel")
    assert permissions.any(["doctor.appointment/cancel", "doctor.appointment/complete"])
    assert not permissions.has_any([])
    assert permissions.has_all([])


def test_page_action_categories_and_resource_wildcards() -> None:
    """Explicit page/action categories share checks without overloading UI code."""

    permissions = PermissionSet(
        pages=["patients/view"],
        actions=["tcm.prescriptionLibrary/*"],
    )

    assert permissions.can_access_page("patients/view")
    assert permissions.can("tcm.prescriptionLibrary", "add")
    assert permissions.can_perform_action("tcm.prescriptionLibrary/delete")
    assert not permissions.can_perform_action("tcm.prescription/delete")
    assert "patients/view" in permissions


def test_permission_set_normalises_and_deduplicates_values() -> None:
    """Whitespace and duplicates do not create surprising guard results."""

    permissions = PermissionSet(["  alpha/read ", "alpha/read", ""])

    assert list(permissions) == ["alpha/read"]
    assert len(permissions) == 1
    assert bool(permissions)