package authn

import "testing"

// TestCanRead pins the read-plane ACL every surface shares: the owner and its
// agents may read, and every other principal — including an unrecognised or
// zero Kind — is denied rather than accidentally admitted.
func TestCanRead(t *testing.T) {
	cases := []struct {
		name string
		p    Principal
		want bool
	}{
		{"owner may read", Principal{Kind: KindOwner}, true},
		{"agent may read", Principal{Kind: KindAgent}, true},
		{"anonymous may not", Anonymous(), false},
		{"zero value may not", Principal{}, false},
		{"unknown kind may not", Principal{Kind: "wat"}, false},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			if got := tc.p.CanRead(); got != tc.want {
				t.Errorf("CanRead() = %v, want %v", got, tc.want)
			}
		})
	}
}