*** Settings ***
Documentation     Permission system integration tests — role-based access control
Library           OperatingSystem
Library           Collections
Library           String
Library           Process
Library           helper_permission_system.py
Resource          ${CURDIR}/common.resource

*** Variables ***
${SRC_DIR}        ${CURDIR}/../src/cleveragents

*** Test Cases ***
Permission Module Exists
    [Documentation]    Verify the permission domain model module is present
    File Should Exist    ${SRC_DIR}/domain/models/core/permission.py

Permission Service Module Exists
    [Documentation]    Verify the permission service module is present
    File Should Exist    ${SRC_DIR}/application/services/permission_service.py

Permission Module Exports Expected Enums
    [Documentation]    Verify permission.py exports public enums
    ${content}=    Get File    ${SRC_DIR}/domain/models/core/permission.py
    Should Contain    ${content}    class PermissionRole
    Should Contain    ${content}    class PermissionScope
    Should Contain    ${content}    class PermissionAction

Permission Module Exports Models
    [Documentation]    Verify permission.py exports data models
    ${content}=    Get File    ${SRC_DIR}/domain/models/core/permission.py
    Should Contain    ${content}    class RoleBinding
    Should Contain    ${content}    class PermissionCheck
    Should Contain    ${content}    class PermissionPolicy

Permission Module Exports Constants
    [Documentation]    Verify permission.py exports constant mappings
    ${content}=    Get File    ${SRC_DIR}/domain/models/core/permission.py
    Should Contain    ${content}    ROLE_PERMISSIONS
    Should Contain    ${content}    DEFAULT_LOCAL_ROLE_MAPPING

Service Module Exports Expected Symbols
    [Documentation]    Verify permission_service.py exports public API
    ${content}=    Get File    ${SRC_DIR}/application/services/permission_service.py
    Should Contain    ${content}    class PermissionService
    Should Contain    ${content}    def check_permission
    Should Contain    ${content}    def enforce_permission
    Should Contain    ${content}    def is_local_mode
    Should Contain    ${content}    def get_role_bindings

Core Init Exports Permission Models
    [Documentation]    Verify core __init__.py re-exports permission types
    ${content}=    Get File    ${SRC_DIR}/domain/models/core/__init__.py
    Should Contain    ${content}    PermissionRole
    Should Contain    ${content}    PermissionScope
    Should Contain    ${content}    PermissionAction
    Should Contain    ${content}    RoleBinding
    Should Contain    ${content}    PermissionCheck
    Should Contain    ${content}    PermissionPolicy
    Should Contain    ${content}    ROLE_PERMISSIONS
    Should Contain    ${content}    DEFAULT_LOCAL_ROLE_MAPPING

Services Init Exports Permission Service
    [Documentation]    Verify services __init__.py re-exports PermissionService
    ${content}=    Get File    ${SRC_DIR}/application/services/__init__.py
    Should Contain    ${content}    PermissionService
    Should Contain    ${content}    enforce_permission

Permission Role Enum Values Via Python
    [Documentation]    Verify PermissionRole values using helper
    @{roles}=    Get Permission Roles
    Should Contain    ${roles}    owner
    Should Contain    ${roles}    admin
    Should Contain    ${roles}    editor
    Should Contain    ${roles}    viewer
    Length Should Be    ${roles}    4

Permission Scope Enum Values Via Python
    [Documentation]    Verify PermissionScope values using helper
    @{scopes}=    Get Permission Scopes
    Should Contain    ${scopes}    namespace
    Should Contain    ${scopes}    project
    Should Contain    ${scopes}    plan
    Should Contain    ${scopes}    skill
    Length Should Be    ${scopes}    4

Permission Action Enum Values Via Python
    [Documentation]    Verify PermissionAction values using helper
    @{actions}=    Get Permission Actions
    Should Contain    ${actions}    read
    Should Contain    ${actions}    write
    Should Contain    ${actions}    execute
    Should Contain    ${actions}    delete
    Should Contain    ${actions}    admin
    Length Should Be    ${actions}    5

Local Mode Permission Check Via Python
    [Documentation]    Verify local mode always permits
    ${result}=    Check Permission Local Mode    alice    write    project    proj-1
    Should Be True    ${result}

Server Mode Denied Without Binding Via Python
    [Documentation]    Verify server mode denies without bindings
    ${result}=    Check Permission Server No Bindings    alice    write    project    proj-1
    Should Not Be True    ${result}

Server Mode Allows With Binding Via Python
    [Documentation]    Verify server mode allows when binding exists
    ${result}=    Check Permission Server With Binding    alice    editor    read    project    proj-1
    Should Be True    ${result}

Owner Role Has All Actions Via Python
    [Documentation]    Verify OWNER role maps to all 5 actions
    ${count}=    Get Role Action Count    owner
    Should Be Equal As Integers    ${count}    5

Viewer Role Has Only Read Via Python
    [Documentation]    Verify VIEWER role maps to 1 action
    ${count}=    Get Role Action Count    viewer
    Should Be Equal As Integers    ${count}    1

Default Local Role Mapping Via Python
    [Documentation]    Verify wildcard maps to owner
    ${role}=    Get Default Local Role
    Should Be Equal    ${role}    owner

Documentation File Exists
    [Documentation]    Verify reference documentation was created
    File Should Exist    ${CURDIR}/../docs/reference/permissions.md