import 'reflect-metadata';
import assert from 'node:assert/strict';
import test from 'node:test';
import { REQUIRED_PERMISSIONS_KEY } from '../../src/authorization/decorators/require-permissions.decorator';
import { SurveyExecutionController } from '../../src/survey-execution/survey-execution.controller';

function permissionFor(method: string): string[] {
  const controller = SurveyExecutionController.prototype;
  const handler = controller[method as keyof typeof controller];
  return Reflect.getMetadata(REQUIRED_PERMISSIONS_KEY, handler) as string[];
}

test('survey report endpoints separate reading, capture and review', () => {
  assert.deepEqual(permissionFor('get'), ['surveys.read_reports']);
  assert.deepEqual(permissionFor('save'), ['surveys.capture']);
  assert.deepEqual(permissionFor('submit'), ['surveys.capture']);
  assert.deepEqual(permissionFor('review'), ['surveys.review']);
});