import 'reflect-metadata';
import assert from 'node:assert/strict';
import test from 'node:test';
import { AssetProvenanceController } from '../../src/asset-master/asset-provenance.controller';
import { AssetTemporalController } from '../../src/asset-master/asset-temporal.controller';
import { REQUIRED_PERMISSIONS_KEY } from '../../src/authorization/decorators/require-permissions.decorator';

function permissionFor(controller: object, method: string): string[] {
  const handler = controller[method as keyof typeof controller];
  return Reflect.getMetadata(REQUIRED_PERMISSIONS_KEY, handler) as string[];
}

test('provenance reads, updates and verification use separate permissions', () => {
  const controller = AssetProvenanceController.prototype;
  assert.deepEqual(permissionFor(controller, 'get'), ['assets.read_provenance']);
  assert.deepEqual(permissionFor(controller, 'update'), ['assets.manage_provenance']);
  assert.deepEqual(permissionFor(controller, 'verify'), ['assets.verify_provenance']);
});

test('all temporal reconstruction endpoints require temporal reading', () => {
  const controller = AssetTemporalController.prototype;
  assert.deepEqual(permissionFor(controller, 'list'), ['assets.read_temporal']);
  assert.deepEqual(permissionFor(controller, 'get'), ['assets.read_temporal']);
});