def test_fixed_role_permission_matrix_is_monotonic():
    from app.core.system.permissions import ROLE_PERMISSIONS

    viewer = ROLE_PERMISSIONS["viewer"]
    editor = ROLE_PERMISSIONS["editor"]
    admin = ROLE_PERMISSIONS["admin"]

    assert viewer < editor < admin
    assert "governance:read" in viewer
    assert "governance:edit" in editor
    assert "users:manage" in admin
    assert "workflow:activate" in admin


def test_permissions_are_derived_server_side_from_roles():
    from app.core.system.permissions import permissions_for_roles

    permissions = permissions_for_roles(["viewer", "editor"])

    assert "governance:read" in permissions
    assert "governance:edit" in permissions
    assert "users:manage" not in permissions


def test_every_api_path_has_an_explicit_policy():
    from app import create_app
    from app.core.system.permissions import permission_for_request

    app = create_app()
    for rule in app.url_map.iter_rules():
        if not rule.rule.startswith("/api/"):
            continue
        for method in rule.methods - {"HEAD", "OPTIONS"}:
            assert permission_for_request(rule.rule, method) is not None, (
                method,
                rule.rule,
            )