neiam /gitgud

defmodule GitGud.Workflows.PermissionsTest do
  use ExUnit.Case, async: true

  alias GitGud.Workflows.Permissions

  @default %{"contents" => :read, "packages" => :write, "actions" => :write}

  test "no permissions: anywhere keeps what job tokens always could" do
    assert Permissions.effective(%{"on" => "push"}, %{"runs-on" => "x"}) == @default
    assert Permissions.effective(nil, nil) == @default
  end

  test "read-all and write-all" do
    assert Permissions.effective(%{"permissions" => "read-all"}, %{}) ==
             %{"contents" => :read, "packages" => :read, "actions" => :read}

    assert Permissions.effective(%{"permissions" => "write-all"}, %{}) ==
             %{"contents" => :write, "packages" => :write, "actions" => :write}
  end

  test "{} is nothing" do
    assert Permissions.effective(%{"permissions" => %{}}, %{}) ==
             %{"contents" => :none, "packages" => :none, "actions" => :none}
  end

  test "a map leaves every scope it doesn't name at none" do
    assert Permissions.effective(%{"permissions" => %{"contents" => "write"}}, %{}) ==
             %{"contents" => :write, "packages" => :none, "actions" => :none}
  end

  test "scopes gitgud doesn't use are accepted and ignored" do
    doc = %{"permissions" => %{"issues" => "write", "id-token" => "write", "packages" => "read"}}

    assert Permissions.effective(doc, %{}) ==
             %{"contents" => :none, "packages" => :read, "actions" => :none}
  end

  test "the job's permissions replace the workflow's, with no merge" do
    doc = %{"permissions" => %{"contents" => "write", "packages" => "write"}}
    job = %{"permissions" => %{"packages" => "read"}}

    assert Permissions.effective(doc, job) ==
             %{"contents" => :none, "packages" => :read, "actions" => :none}

    assert Permissions.effective(doc, %{"permissions" => %{}}) ==
             %{"contents" => :none, "packages" => :none, "actions" => :none}
  end

  test "values it doesn't understand grant nothing" do
    assert Permissions.effective(%{"permissions" => %{"contents" => "admin"}}, %{}) ==
             %{"contents" => :none, "packages" => :none, "actions" => :none}

    assert Permissions.effective(%{"permissions" => "everything"}, %{}) ==
             %{"contents" => :none, "packages" => :none, "actions" => :none}
  end
end