init push

internal/app/api/seed_permissions_test.go

@@ -0,0 +1,34 @@
+package api
+
+import (
+	"testing"
+
+	"wucher/internal/domain/auth"
+)
+
+// TestDefaultPermissionsHaveRegisteredModule guards that every seeded permission
+// maps to a module declared in auth.ModuleRegistry. Adding a permission with a
+// new prefix without registering its module will fail this test.
+func TestDefaultPermissionsHaveRegisteredModule(t *testing.T) {
+	for _, p := range DefaultPermissions() {
+		module := auth.ModuleForKey(p.Key)
+		if !auth.IsRegisteredModule(module) {
+			t.Errorf("permission %q maps to module %q which is not in auth.ModuleRegistry", p.Key, module)
+		}
+	}
+}
+
+// TestDefaultPermissionsHaveUniqueKeys guards against accidental duplicate keys
+// in the catalog (the upsert is keyed on "key").
+func TestDefaultPermissionsHaveUniqueKeys(t *testing.T) {
+	seen := make(map[string]bool)
+	for _, p := range DefaultPermissions() {
+		if p.Key == "" {
+			t.Errorf("permission %q has an empty key", p.Name)
+		}
+		if seen[p.Key] {
+			t.Errorf("duplicate permission key %q in DefaultPermissions", p.Key)
+		}
+		seen[p.Key] = true
+	}
+}