heicode-mananger/heicode/controller/agent_role_template_test.go

package controller

import (
	"net/http/httptest"
	"strings"
	"testing"

	"github.com/gin-gonic/gin"
	"github.com/heicode/manager/common"
)

func TestAgentRoleTemplates_CanonicalSetCovered(t *testing.T) {
	// Pins the six canonical role keys from docs §13.3.3. Any code
	// change that adds, removes or renames a key MUST update this
	// list — guards against accidental drift between Manager and
	// the product spec.
	want := []string{"product", "architect", "frontend", "backend", "reviewer", "ops"}
	got := agentRoleTemplates()
	if len(got) != len(want) {
		t.Fatalf("expected %d roles, got %d", len(want), len(got))
	}
	for i, key := range want {
		if got[i].Key != key {
			t.Errorf("position %d: want key %q, got %q", i, key, got[i].Key)
		}
		// Display + summary populated; never returning a blank-row
		// in the picker.
		if strings.TrimSpace(got[i].DisplayName) == "" {
			t.Errorf("role %q has empty DisplayName", key)
		}
		if strings.TrimSpace(got[i].Summary) == "" {
			t.Errorf("role %q has empty Summary", key)
		}
		if len(got[i].DefaultPermissions) == 0 {
			t.Errorf("role %q has empty DefaultPermissions", key)
		}
	}
}

func TestAgentRoleTemplates_RiskLevels(t *testing.T) {
	// Ops is the only canonical role with high risk (production
	// deployment intent). Reviewer + Product + Architect stay low
	// (read-mostly). Frontend + Backend land at medium. Pins the
	// product-doc default risk classification so we don't silently
	// flip an ops role to "low" and skip the high-risk approval
	// gating downstream.
	wantRisk := map[string]string{
		"product":   agentRiskLow,
		"architect": agentRiskLow,
		"reviewer":  agentRiskLow,
		"frontend":  agentRiskMedium,
		"backend":   agentRiskMedium,
		"ops":       agentRiskHigh,
	}
	for _, tpl := range agentRoleTemplates() {
		if want, ok := wantRisk[tpl.Key]; ok && tpl.RiskLevel != want {
			t.Errorf("role %q: want risk %q, got %q", tpl.Key, want, tpl.RiskLevel)
		}
	}
}

func TestAgentListRoleTemplates_HTTPShape(t *testing.T) {
	gin.SetMode(gin.TestMode)
	rec := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(rec)
	c.Request = httptest.NewRequest("GET", "/api/agent/role-templates", nil)
	c.Set("id", 1)
	c.Set("role", common.RoleCommonUser)

	AgentListRoleTemplates(c)

	if rec.Code != 200 {
		t.Fatalf("expected 200, got %d body=%s", rec.Code, rec.Body.String())
	}
	body := rec.Body.String()
	// Stable keys the frontend depends on — checked via substring
	// rather than parsing so we don't have to spin up a typed
	// envelope just for this guard.
	for _, want := range []string{`"items"`, `"total"`, `"product"`, `"ops"`, `"display_name"`} {
		if !strings.Contains(body, want) {
			t.Errorf("response missing %q. body=%s", want, body)
		}
	}
}

func TestAgentIsCanonicalRoleKey(t *testing.T) {
	// Defensive helper currently used as advisory — pins the closed
	// set so the future tighten-up to closed-set validation is one
	// flip instead of an open-ended audit.
	for _, ok := range []string{"product", "architect", "frontend", "backend", "reviewer", "ops"} {
		if !agentIsCanonicalRoleKey(ok) {
			t.Errorf("%q should be canonical", ok)
		}
	}
	for _, bad := range []string{"", "debugger", "executor", "random_string"} {
		if agentIsCanonicalRoleKey(bad) {
			t.Errorf("%q should NOT be canonical", bad)
		}
	}
}