package bootstrap

import "testing"

// TestStandardPermissionsApiEnabledGrantedToStandardUser asserts that the
// platform permission catalog declares ApiEnabled as a default grant for the
// StandardUser audience. This ensures that after cmd/setup apply, any user
// assigned to the Standard User profile can reach REST endpoints protected by
// the ApiEnabled permission middleware.
//
// This is a pure-data test: it parses the embedded JSON catalog without a DB
// and verifies the defaultGrantedTo declaration that drives Batch 2 of
// seedSystemPermissionRows (INSERT IGNORE into _System_PermissionSetPermission).
func TestStandardPermissionsApiEnabledGrantedToStandardUser(t *testing.T) {
	rows, err := LoadStandardPermissions()
	if err != nil {
		t.Fatalf("LoadStandardPermissions: %v", err)
	}

	var found bool
	for _, row := range rows {
		if row.APIName != "ApiEnabled" {
			continue
		}
		for _, audience := range row.DefaultGrantedTo {
			if audience == "StandardUser" {
				found = true
				break
			}
		}
		if !found {
			t.Errorf("ApiEnabled.defaultGrantedTo = %v, want it to contain \"StandardUser\"", row.DefaultGrantedTo)
		}
		return
	}

	if !found {
		t.Error("ApiEnabled permission entry not found in standard_permissions.json")
	}
}