ave-http 0.11.0

// Ave HTTP Auth System - Role Change Tests
//
// Tests for role changes and their effects on API keys and permissions

pub mod common;
use common::{
    TestDbExt, materialize_role_test_path, role_test_request_body,
    server_auth_route_catalog, server_main_route_catalog,
};

use ave_http::auth::database::DatabaseError;
use reqwest::{Client, StatusCode};
use serde_json::json;
use std::collections::BTreeSet;
use test_log::test;

#[test(tokio::test)]
async fn test_api_keys_revoked_when_role_added() {
    let (db, _dirs) = common::create_test_db();

    let user = db
        .create_user_transactional(
            "testuser",
            "TestPass123!",
            None,
            None,
            Some(false),
            None,
        )
        .unwrap();
    let (api_key, _) = db
        .create_api_key(user.id, Some("key1"), None, None, false)
        .unwrap();

    // Verify key works
    assert!(
        db.authenticate_api_key_request(&api_key, None, "/peer-id")
            .is_ok()
    );

    let role = db.create_role_transactional("editor", None, None).unwrap();
    db.assign_role_to_user_transactional(user.id, role.id, None, None)
        .unwrap();

    // API key should be revoked
    let result = db.authenticate_api_key_request(&api_key, None, "/peer-id");
    assert!(matches!(result, Err(DatabaseError::PermissionDenied(_))));
}

#[test(tokio::test)]
async fn test_api_keys_revoked_when_role_removed() {
    let (db, _dirs) = common::create_test_db();

    let user = db
        .create_user("testuser", "TestPass123!", None, None, Some(false))
        .unwrap();
    let role = db.create_role("editor", None).unwrap();

    db.assign_role_to_user(user.id, role.id, None).unwrap();

    let (api_key, _) = db
        .create_api_key(user.id, Some("key1"), None, None, false)
        .unwrap();

    // Verify key works
    assert!(
        db.authenticate_api_key_request(&api_key, None, "/peer-id")
            .is_ok()
    );

    // Remove role from user
    db.remove_role_from_user(user.id, role.id).unwrap();

    // API key should be revoked
    let result = db.authenticate_api_key_request(&api_key, None, "/peer-id");
    assert!(matches!(result, Err(DatabaseError::PermissionDenied(_))));
}

#[test(tokio::test)]
async fn test_permissions_change_when_role_added() {
    let (db, _dirs) = common::create_test_db();

    let user = db
        .create_user("testuser", "TestPass123!", None, None, Some(false))
        .unwrap();
    let role = db.create_role("editor", None).unwrap();

    // Role has read permission
    db.set_role_permission(role.id, "node_subject", "get", true)
        .unwrap();

    // User doesn't have permission yet
    let perms_before = db.get_user_effective_permissions(user.id).unwrap();
    assert!(!perms_before.iter().any(|p| p.resource == "node_subject"
        && p.action == "get"
        && p.allowed));

    // Assign role
    db.assign_role_to_user(user.id, role.id, None).unwrap();

    // User should now have permission
    let perms_after = db.get_user_effective_permissions(user.id).unwrap();
    assert!(perms_after.iter().any(|p| p.resource == "node_subject"
        && p.action == "get"
        && p.allowed));
}

#[test(tokio::test)]
async fn test_permissions_change_when_role_removed() {
    let (db, _dirs) = common::create_test_db();

    let user = db
        .create_user("testuser", "TestPass123!", None, None, Some(false))
        .unwrap();
    let role = db.create_role("editor", None).unwrap();

    // Role has update permission
    db.set_role_permission(role.id, "node_request", "post", true)
        .unwrap();
    db.assign_role_to_user(user.id, role.id, None).unwrap();

    // User has permission
    let perms_before = db.get_user_effective_permissions(user.id).unwrap();
    assert!(perms_before.iter().any(|p| p.resource == "node_request"
        && p.action == "post"
        && p.allowed));

    // Remove role
    db.remove_role_from_user(user.id, role.id).unwrap();

    // User should no longer have permission
    let perms_after = db.get_user_effective_permissions(user.id).unwrap();
    assert!(!perms_after.iter().any(|p| p.resource == "node_request"
        && p.action == "post"
        && p.allowed));
}

#[test(tokio::test)]
async fn test_multiple_role_changes() {
    let (db, _dirs) = common::create_test_db();

    let user = db
        .create_user("testuser", "TestPass123!", None, None, Some(false))
        .unwrap();
    let (api_key1, _) = db
        .create_api_key(user.id, Some("key1"), None, None, false)
        .unwrap();

    let role1 = db.create_role("role1", None).unwrap();
    db.assign_role_to_user(user.id, role1.id, None).unwrap();

    // First key should be revoked
    assert!(matches!(
        db.authenticate_api_key_request(&api_key1, None, "/peer-id"),
        Err(DatabaseError::PermissionDenied(_))
    ));

    // Create new key
    let (api_key2, _) = db
        .create_api_key(user.id, Some("key2"), None, None, false)
        .unwrap();

    let role2 = db.create_role("role2", None).unwrap();
    db.assign_role_to_user(user.id, role2.id, None).unwrap();

    // Second key should be revoked
    assert!(matches!(
        db.authenticate_api_key_request(&api_key2, None, "/peer-id"),
        Err(DatabaseError::PermissionDenied(_))
    ));

    // First key still revoked
    assert!(matches!(
        db.authenticate_api_key_request(&api_key1, None, "/peer-id"),
        Err(DatabaseError::PermissionDenied(_))
    ));
}

#[test(tokio::test)]
async fn test_user_with_multiple_roles_permission_merge() {
    let (db, _dirs) = common::create_test_db();

    let user = db
        .create_user("testuser", "TestPass123!", None, None, Some(false))
        .unwrap();
    let role1 = db.create_role("reader", None).unwrap();
    let role2 = db.create_role("writer", None).unwrap();

    // role1 grants read
    db.set_role_permission(role1.id, "node_subject", "get", true)
        .unwrap();

    // role2 grants update
    db.set_role_permission(role2.id, "node_subject", "post", true)
        .unwrap();

    // Assign both roles
    db.assign_role_to_user(user.id, role1.id, None).unwrap();
    db.assign_role_to_user(user.id, role2.id, None).unwrap();

    // User should have both permissions
    let perms = db.get_user_effective_permissions(user.id).unwrap();

    assert!(perms.iter().any(|p| p.resource == "node_subject"
        && p.action == "get"
        && p.allowed));
    assert!(perms.iter().any(|p| p.resource == "node_subject"
        && p.action == "post"
        && p.allowed));
}

#[test(tokio::test)]
async fn test_user_override_persists_through_role_changes() {
    let (db, _dirs) = common::create_test_db();

    let user = db
        .create_user("testuser", "TestPass123!", None, None, Some(false))
        .unwrap();

    // User has explicit deny
    db.set_user_permission(user.id, "admin_users", "delete", false, None)
        .unwrap();

    // Add role that grants delete
    let role = db.create_role("user_admin", None).unwrap();
    db.set_role_permission(role.id, "admin_users", "delete", true)
        .unwrap();
    db.assign_role_to_user(user.id, role.id, None).unwrap();

    // User override should still deny
    let perms = db.get_user_effective_permissions(user.id).unwrap();
    let perm = perms
        .iter()
        .find(|p| p.resource == "admin_users" && p.action == "delete")
        .unwrap();

    assert!(!perm.allowed);
}

#[test(tokio::test)]
async fn test_role_permission_modification_affects_all_users() {
    let (db, _dirs) = common::create_test_db();

    let user1 = db
        .create_user("user1", "TestPass123!", None, None, Some(false))
        .unwrap();
    let user2 = db
        .create_user("user2", "TestPass123!", None, None, Some(false))
        .unwrap();
    let role = db.create_role("editor", None).unwrap();

    db.assign_role_to_user(user1.id, role.id, None).unwrap();
    db.assign_role_to_user(user2.id, role.id, None).unwrap();

    // Grant permission to role
    db.set_role_permission(role.id, "node_subject", "post", true)
        .unwrap();

    // Both users should have the permission
    let perms1 = db.get_user_effective_permissions(user1.id).unwrap();
    let perms2 = db.get_user_effective_permissions(user2.id).unwrap();

    assert!(perms1.iter().any(|p| p.resource == "node_subject"
        && p.action == "post"
        && p.allowed));
    assert!(perms2.iter().any(|p| p.resource == "node_subject"
        && p.action == "post"
        && p.allowed));

    // Revoke permission from role
    db.set_role_permission(role.id, "node_subject", "post", false)
        .unwrap();

    // Both users should lose the permission
    let perms1 = db.get_user_effective_permissions(user1.id).unwrap();
    let perms2 = db.get_user_effective_permissions(user2.id).unwrap();

    assert!(!perms1.iter().any(|p| p.resource == "node_subject"
        && p.action == "post"
        && p.allowed));
    assert!(!perms2.iter().any(|p| p.resource == "node_subject"
        && p.action == "post"
        && p.allowed));
}

#[test(tokio::test)]
async fn test_deny_permission_overrides_multiple_allows() {
    let (db, _dirs) = common::create_test_db();

    let user = db
        .create_user("testuser", "TestPass123!", None, None, Some(false))
        .unwrap();
    let role1 = db.create_role("role1", None).unwrap();
    let role2 = db.create_role("role2", None).unwrap();

    // Both roles grant permission
    db.set_role_permission(role1.id, "node_subject", "delete", true)
        .unwrap();
    db.set_role_permission(role2.id, "node_subject", "delete", true)
        .unwrap();

    db.assign_role_to_user(user.id, role1.id, None).unwrap();
    db.assign_role_to_user(user.id, role2.id, None).unwrap();

    // User-specific deny
    db.set_user_permission(user.id, "node_subject", "delete", false, None)
        .unwrap();

    // Deny should override both role allows
    let perms = db.get_user_effective_permissions(user.id).unwrap();
    let perm = perms
        .iter()
        .find(|p| p.resource == "node_subject" && p.action == "delete")
        .unwrap();

    assert!(!perm.allowed);
}

#[test(tokio::test)]
async fn test_deleted_roles_removed_from_users() {
    let (db, _dirs) = common::create_test_db();

    let user = db
        .create_user("testuser", "TestPass123!", None, None, Some(false))
        .unwrap();
    let role = db.create_role("temp_role", None).unwrap();

    db.assign_role_to_user(user.id, role.id, None).unwrap();

    // User has the role
    let roles_before = db.get_user_roles(user.id).unwrap();
    assert!(roles_before.contains(&"temp_role".to_string()));

    // Delete role
    db.delete_role(role.id).unwrap();

    // User should no longer have the role
    let roles_after = db.get_user_roles(user.id).unwrap();
    assert!(!roles_after.contains(&"temp_role".to_string()));
}

// =============================================================================
// ENDPOINT ACCESS TESTS BY ROLE
// =============================================================================

/// Helper to check if a status code indicates access was granted
fn has_access(status: StatusCode) -> bool {
    // 401 = Unauthorized, 403 = Forbidden -> NO ACCESS
    // Everything else including 404 (resource not found but endpoint accessible) -> HAS ACCESS
    // 404 means the user has permission to access the endpoint, but the resource doesn't exist
    !matches!(status, StatusCode::UNAUTHORIZED | StatusCode::FORBIDDEN)
}

fn node_routes() -> BTreeSet<(String, String)> {
    server_main_route_catalog()
}

fn user_routes() -> BTreeSet<(String, String)> {
    server_auth_route_catalog()
        .into_iter()
        .filter(|(_, path)| {
            *path == "/me"
                || *path == "/me/permissions"
                || *path == "/me/permissions/detailed"
        })
        .collect()
}

fn user_api_key_routes() -> BTreeSet<(String, String)> {
    server_auth_route_catalog()
        .into_iter()
        .filter(|(_, path)| {
            *path == "/me/api-keys" || *path == "/me/api-keys/{name}"
        })
        .collect()
}

fn admin_users_routes() -> BTreeSet<(String, String)> {
    server_auth_route_catalog()
        .into_iter()
        .filter(|(_, path)| path.starts_with("/admin/users"))
        .collect()
}

fn admin_roles_routes() -> BTreeSet<(String, String)> {
    server_auth_route_catalog()
        .into_iter()
        .filter(|(_, path)| path.starts_with("/admin/roles"))
        .collect()
}

fn admin_apikey_routes() -> BTreeSet<(String, String)> {
    server_auth_route_catalog()
        .into_iter()
        .filter(|(_, path)| {
            path.starts_with("/admin/api-keys")
                || path.starts_with("/admin/usage-plans")
        })
        .collect()
}

fn admin_system_routes() -> BTreeSet<(String, String)> {
    server_auth_route_catalog()
        .into_iter()
        .filter(|(_, path)| {
            matches!(
                path.as_str(),
                "/admin/resources"
                    | "/admin/actions"
                    | "/admin/audit-logs"
                    | "/admin/audit-logs/stats"
                    | "/admin/rate-limits/stats"
                    | "/admin/config"
                    | "/admin/config/{key}"
            )
        })
        .collect()
}

async fn execute_role_endpoint(
    client: &Client,
    base_url: &str,
    api_key: &str,
    method: &str,
    path: &str,
) -> StatusCode {
    let url =
        format!("{}{}", base_url, materialize_role_test_path(method, path));
    let body = role_test_request_body(method, path);

    let request = match method {
        "get" => client.get(&url),
        "post" => client.post(&url).json(&body.unwrap_or(json!({}))),
        "put" => client.put(&url).json(&body.unwrap_or(json!({}))),
        "patch" => client.patch(&url).json(&body.unwrap_or(json!({}))),
        "delete" => {
            let request = client.delete(&url);
            if let Some(body) = body {
                request.json(&body)
            } else {
                request
            }
        }
        _ => panic!("Unsupported method: {method}"),
    };

    request
        .header("X-API-Key", api_key)
        .send()
        .await
        .unwrap()
        .status()
}

/// Test all Node (business logic) endpoints
async fn test_node_endpoints(
    client: &Client,
    base_url: &str,
    api_key: &str,
    default_access: bool,
    overrides: &[(&str, &str, bool)],
) {
    for (method, path) in node_routes() {
        let status =
            execute_role_endpoint(client, base_url, api_key, &method, &path)
                .await;
        let expected_access = overrides
            .iter()
            .find(|(m, p, _)| m.eq_ignore_ascii_case(&method) && *p == path)
            .map(|(_, _, allow)| *allow)
            .unwrap_or(default_access);

        let access = has_access(status);

        assert_eq!(
            access, expected_access,
            "{} {} - Expected access: {}, Got status: {} (access: {})",
            method, path, expected_access, status, access
        );
    }
}

/// Test all User endpoints (/me/...)
async fn test_user_endpoints(
    client: &Client,
    base_url: &str,
    api_key: &str,
    should_have_access: bool,
    is_management_key: bool,
) {
    for (method, path) in user_routes() {
        let status =
            execute_role_endpoint(client, base_url, api_key, &method, &path)
                .await;
        let access = has_access(status);

        assert_eq!(
            access, should_have_access,
            "{} {} - Expected access: {}, Got status: {} (access: {})",
            method, path, should_have_access, status, access
        );
    }

    for (method, path) in user_api_key_routes() {
        let status =
            execute_role_endpoint(client, base_url, api_key, &method, &path)
                .await;
        let access = has_access(status);
        let expected_access = should_have_access && is_management_key;

        assert_eq!(
            access, expected_access,
            "{} {} (is_management: {}) - Expected access: {}, Got status: {} (access: {})",
            method, path, is_management_key, expected_access, status, access
        );
    }
}

/// Test all Admin-Users endpoints
async fn test_admin_users_endpoints(
    client: &Client,
    base_url: &str,
    api_key: &str,
    should_have_access: bool,
) {
    for (method, path) in admin_users_routes() {
        let status =
            execute_role_endpoint(client, base_url, api_key, &method, &path)
                .await;
        let access = has_access(status);

        assert_eq!(
            access, should_have_access,
            "{} {} - Expected access: {}, Got status: {} (access: {})",
            method, path, should_have_access, status, access
        );
    }
}

/// Test all Admin-Roles endpoints
async fn test_admin_roles_endpoints(
    client: &Client,
    base_url: &str,
    api_key: &str,
    should_have_access: bool,
    is_superadmin: bool,
) {
    for (method, path) in admin_roles_routes() {
        let status =
            execute_role_endpoint(client, base_url, api_key, &method, &path)
                .await;
        let access = has_access(status);
        let expected_access = match (method.as_str(), path.as_str()) {
            ("post", "/admin/roles/{role_id}/permissions")
            | ("delete", "/admin/roles/{role_id}/permissions") => {
                should_have_access && is_superadmin
            }
            _ => should_have_access,
        };

        assert_eq!(
            access, expected_access,
            "{} {} - Expected access: {}, Got status: {} (access: {})",
            method, path, expected_access, status, access
        );
    }
}

/// Test all Admin-ApiKey endpoints
async fn test_admin_apikeys_endpoints(
    client: &Client,
    base_url: &str,
    api_key: &str,
    should_have_access: bool,
    is_superadmin: bool,
) {
    for (method, path) in admin_apikey_routes() {
        let status =
            execute_role_endpoint(client, base_url, api_key, &method, &path)
                .await;
        let access = has_access(status);
        let expected_access = match (method.as_str(), path.as_str()) {
            ("post", "/admin/api-keys/user/{user_id}") => {
                should_have_access && is_superadmin
            }
            _ => should_have_access,
        };

        assert_eq!(
            access, expected_access,
            "{} {} - Expected access: {}, Got status: {} (access: {})",
            method, path, expected_access, status, access
        );
    }
}

/// Test all Admin-System endpoints
async fn test_admin_system_endpoints(
    client: &Client,
    base_url: &str,
    api_key: &str,
    should_have_access: bool,
) {
    for (method, path) in admin_system_routes() {
        let status =
            execute_role_endpoint(client, base_url, api_key, &method, &path)
                .await;
        let access = has_access(status);

        assert_eq!(
            access, should_have_access,
            "{} {} - Expected access: {}, Got status: {} (access: {})",
            method, path, should_have_access, status, access
        );
    }
}

#[test(tokio::test)]
async fn test_superadmin_all_endpoints_access() {
    let Some((server, _dirs)) =
        common::TestServer::build(true, false, None).await
    else {
        return;
    };
    let client = Client::new();
    let base_url = server.url("");

    // Login as default admin (which is a superadmin)
    let (status, login_response) = common::make_request(
        &client,
        &server.url("/login"),
        "POST",
        None,
        Some(json!({"username": "admin", "password": "AdminPass123!"})),
    )
    .await;

    assert!(status.is_success(), "Login failed with status: {}", status);
    let mgmt_key = login_response["api_key"]
        .as_str()
        .expect("No api_key in login response")
        .to_string();

    // Create service key using management key
    let (status, service_key_response) = common::make_request(
        &client,
        &server.url("/me/api-keys"),
        "POST",
        Some(&mgmt_key),
        Some(json!({"name": "service_test"})),
    )
    .await;

    assert!(
        status.is_success(),
        "Service key creation failed with status: {}",
        status
    );
    let service_key = service_key_response["api_key"]
        .as_str()
        .expect("No api_key in service key response")
        .to_string();

    let superadmin_mgmt_overrides: &[(&str, &str, bool)] = &[];
    let superadmin_service_overrides: &[(&str, &str, bool)] =
        &[("delete", "/maintenance/subjects/{subject_id}", false)];

    // Test with management key - should have access to EVERYTHING
    test_node_endpoints(
        &client,
        &base_url,
        &mgmt_key,
        true,
        superadmin_mgmt_overrides,
    )
    .await;
    test_user_endpoints(&client, &base_url, &mgmt_key, true, true).await;
    test_admin_users_endpoints(&client, &base_url, &mgmt_key, true).await;
    test_admin_roles_endpoints(&client, &base_url, &mgmt_key, true, true).await;
    test_admin_apikeys_endpoints(&client, &base_url, &mgmt_key, true, true)
        .await;
    test_admin_system_endpoints(&client, &base_url, &mgmt_key, true).await;

    // Test with service key - should have access to node endpoints and /me (except /me/api-keys)
    // but NO access to /admin/* endpoints (service keys cannot carry admin permissions)
    test_node_endpoints(
        &client,
        &base_url,
        &service_key,
        true,
        superadmin_service_overrides,
    )
    .await;
    test_user_endpoints(&client, &base_url, &service_key, true, false).await;
    test_admin_users_endpoints(&client, &base_url, &service_key, false).await;
    test_admin_roles_endpoints(&client, &base_url, &service_key, false, true)
        .await;
    test_admin_apikeys_endpoints(&client, &base_url, &service_key, false, true)
        .await;
    test_admin_system_endpoints(&client, &base_url, &service_key, false).await;
}

#[test(tokio::test)]

async fn test_admin_role_endpoints_access() {
    let Some((server, _dirs)) =
        common::TestServer::build(true, false, None).await
    else {
        return;
    };
    let client = Client::new();
    let base_url = server.url("");

    // Login as default admin to create test user
    let login_response: serde_json::Value = client
        .post(&server.url("/login"))
        .json(&json!({"username": "admin", "password": "AdminPass123!"}))
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    let admin_api_key = login_response["api_key"].as_str().unwrap();

    // Get Admin role ID
    let roles_response: serde_json::Value = client
        .get(&server.url("/admin/roles"))
        .header("X-API-Key", admin_api_key)
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    let admin_role_id = roles_response
        .as_array()
        .unwrap()
        .iter()
        .find(|r| r["name"] == "admin")
        .unwrap()["id"]
        .as_i64()
        .unwrap();

    // Create test user with Admin role via HTTP
    let _create_user_response: serde_json::Value = client
        .post(&server.url("/admin/users"))
        .header("X-API-Key", admin_api_key)
        .json(&json!({
            "username": "test_admin_user",
            "password": "TestPass123!",
            "is_superadmin": false,
            "role_ids": [admin_role_id],
            "must_change_password": false
        }))
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    // Login as test admin user to get management key
    let test_login_response: serde_json::Value = client
        .post(&server.url("/login"))
        .json(
            &json!({"username": "test_admin_user", "password": "TestPass123!"}),
        )
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    let test_mgmt_key = test_login_response["api_key"].as_str().unwrap();

    // Create service key via /me/api-keys
    let service_key_response: serde_json::Value = client
        .post(&server.url("/me/api-keys"))
        .header("X-API-Key", test_mgmt_key)
        .json(&json!({
            "name": "service_key",
            "is_management": false
        }))
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    eprintln!(
        "ADMIN TEST - Service key response: {:?}",
        service_key_response
    );
    let test_service_key = service_key_response["api_key"].as_str().unwrap();

    // Admin should have access to:
    // - User resources
    // - All Admin-* resources
    // But NOT to Node-* resources

    // Test with management key
    test_user_endpoints(&client, &base_url, test_mgmt_key, true, true).await;
    test_admin_users_endpoints(&client, &base_url, test_mgmt_key, true).await;
    test_admin_roles_endpoints(&client, &base_url, test_mgmt_key, true, false)
        .await;
    test_admin_apikeys_endpoints(
        &client,
        &base_url,
        test_mgmt_key,
        true,
        false,
    )
    .await;
    test_admin_system_endpoints(&client, &base_url, test_mgmt_key, true).await;
    // admin does NOT have node_management:get, so /config is blocked
    test_node_endpoints(&client, &base_url, test_mgmt_key, false, &[]).await; // Should NOT have any node access

    // Test with service key - service keys strip node management permissions,
    // so /config is NOT accessible even for admin service keys
    test_user_endpoints(&client, &base_url, test_service_key, true, false)
        .await;
    test_admin_users_endpoints(&client, &base_url, test_service_key, false)
        .await;
    test_admin_roles_endpoints(
        &client,
        &base_url,
        test_service_key,
        false,
        false,
    )
    .await;
    test_admin_apikeys_endpoints(
        &client,
        &base_url,
        test_service_key,
        false,
        false,
    )
    .await;
    test_admin_system_endpoints(&client, &base_url, test_service_key, false)
        .await;
    test_node_endpoints(&client, &base_url, test_service_key, false, &[]).await; // No node or admin_system access
}

#[test(tokio::test)]

async fn test_sender_role_endpoints_access() {
    let Some((server, _dirs)) =
        common::TestServer::build(true, false, None).await
    else {
        return;
    };
    let client = Client::new();
    let base_url = server.url("");

    // Login as default admin to create test user
    let login_response: serde_json::Value = client
        .post(&server.url("/login"))
        .json(&json!({"username": "admin", "password": "AdminPass123!"}))
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    let admin_api_key = login_response["api_key"].as_str().unwrap();

    // Get Sender role ID
    let roles_response: serde_json::Value = client
        .get(&server.url("/admin/roles"))
        .header("X-API-Key", admin_api_key)
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    let sender_role_id = roles_response
        .as_array()
        .unwrap()
        .iter()
        .find(|r| r["name"] == "sender")
        .unwrap()["id"]
        .as_i64()
        .unwrap();

    // Create test user with Sender role via HTTP
    let _create_user_response: serde_json::Value = client
        .post(&server.url("/admin/users"))
        .header("X-API-Key", admin_api_key)
        .json(&json!({
            "username": "test_sender_user",
            "password": "TestPass123!",
            "is_superadmin": false,
            "role_ids": [sender_role_id],
            "must_change_password": false
        }))
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    // Login as test sender user to get management key
    let test_login_response: serde_json::Value = client
            .post(&server.url("/login"))
            .json(&json!({"username": "test_sender_user", "password": "TestPass123!"}))
            .send()
            .await
            .unwrap()
            .json()
            .await
            .unwrap();

    let test_mgmt_key = test_login_response["api_key"].as_str().unwrap();

    // Create service key via /me/api-keys
    let service_key_response: serde_json::Value = client
        .post(&server.url("/me/api-keys"))
        .header("X-API-Key", test_mgmt_key)
        .json(&json!({
            "name": "service_key",
            "is_management": false
        }))
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    let test_service_key = service_key_response["api_key"].as_str().unwrap();

    // Sender should have access to:
    // - User resources (all actions)
    // - Node-Request (get, post only)
    // But NOT to other Node-* resources or Admin-* resources

    let sender_node_access = [
        // node_request:post
        ("post", "/request", true),
        // node_request:get
        ("get", "/request", true),
        ("get", "/request/{request_id}", true),
        ("get", "/requests-in-manager", true),
        ("get", "/requests-in-manager/{subject_id}", true),
        // node_subject:get
        ("get", "/state/{subject_id}", true),
        ("get", "/events/{subject_id}", true),
        ("get", "/events/{subject_id}/{sn}", true),
        ("get", "/events-first-last/{subject_id}", true),
        ("get", "/aborts/{subject_id}", true),
        ("get", "/subjects", true),
        ("get", "/subjects/{governance_id}", true),
        ("get", "/approval", true),
        ("get", "/approval/{subject_id}", true),
        ("get", "/auth", true),
        ("get", "/auth/{subject_id}", true),
        ("get", "/pending-transfers", true),
        // node_system:get
        ("get", "/public-key", true),
        ("get", "/peer-id", true),
        ("get", "/network-state", true),
        // /config requires node_management:get - sender does NOT have it
    ];

    // Test with management key - limited Node access
    test_user_endpoints(&client, &base_url, test_mgmt_key, true, true).await;
    test_node_endpoints(
        &client,
        &base_url,
        test_mgmt_key,
        false,
        &sender_node_access,
    )
    .await; // Only Node-Request should pass
    test_admin_users_endpoints(&client, &base_url, test_mgmt_key, false).await; // Should NOT have access
    test_admin_roles_endpoints(&client, &base_url, test_mgmt_key, false, false)
        .await; // Should NOT have access
    test_admin_apikeys_endpoints(
        &client,
        &base_url,
        test_mgmt_key,
        false,
        false,
    )
    .await; // Should NOT have access
    test_admin_system_endpoints(&client, &base_url, test_mgmt_key, false).await; // Should NOT have access

    // Test with service key
    test_user_endpoints(&client, &base_url, test_service_key, true, false)
        .await;
    test_node_endpoints(
        &client,
        &base_url,
        test_service_key,
        false,
        &sender_node_access,
    )
    .await; // Only Node-Request should pass
    test_admin_users_endpoints(&client, &base_url, test_service_key, false)
        .await; // Should NOT have access
    test_admin_roles_endpoints(
        &client,
        &base_url,
        test_service_key,
        false,
        false,
    )
    .await; // Should NOT have access
    test_admin_apikeys_endpoints(
        &client,
        &base_url,
        test_service_key,
        false,
        false,
    )
    .await; // Should NOT have access
    test_admin_system_endpoints(&client, &base_url, test_service_key, false)
        .await; // Should NOT have access
}

#[test(tokio::test)]

async fn test_manager_role_endpoints_access() {
    let Some((server, _dirs)) =
        common::TestServer::build(true, false, None).await
    else {
        return;
    };
    let client = Client::new();
    let base_url = server.url("");

    // Login as default admin to create test user
    let login_response: serde_json::Value = client
        .post(&server.url("/login"))
        .json(&json!({"username": "admin", "password": "AdminPass123!"}))
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    let admin_api_key = login_response["api_key"].as_str().unwrap();

    // Get Manager role ID
    let roles_response: serde_json::Value = client
        .get(&server.url("/admin/roles"))
        .header("X-API-Key", admin_api_key)
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    let manager_role_id = roles_response
        .as_array()
        .unwrap()
        .iter()
        .find(|r| r["name"] == "manager")
        .unwrap()["id"]
        .as_i64()
        .unwrap();

    // Create test user with Manager role via HTTP
    let _create_user_response: serde_json::Value = client
        .post(&server.url("/admin/users"))
        .header("X-API-Key", admin_api_key)
        .json(&json!({
            "username": "test_manager_user",
            "password": "TestPass123!",
            "is_superadmin": false,
            "role_ids": [manager_role_id],
            "must_change_password": false
        }))
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    // Login as test manager user to get management key
    let test_login_response: serde_json::Value = client
            .post(&server.url("/login"))
            .json(&json!({"username": "test_manager_user", "password": "TestPass123!"}))
            .send()
            .await
            .unwrap()
            .json()
            .await
            .unwrap();

    let test_mgmt_key = test_login_response["api_key"].as_str().unwrap();

    // Create service key via /me/api-keys
    let service_key_response: serde_json::Value = client
        .post(&server.url("/me/api-keys"))
        .header("X-API-Key", test_mgmt_key)
        .json(&json!({
            "name": "service_key",
            "is_management": false
        }))
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    let test_service_key = service_key_response["api_key"].as_str().unwrap();

    // Manager should have access to:
    // - User resources (all actions)
    // - Node-Request (all actions)
    // - Node-Subject (all actions)
    // - Node-System (all actions)
    // But NOT to Node-Keys or Admin-* resources

    // Manager has node_request:all, node_subject:all, node_system:all, node_management:get
    let manager_overrides: &[(&str, &str, bool)] = &[
        ("get", "/sink-events/{subject_id}", false),
        ("delete", "/maintenance/subjects/{subject_id}", false),
    ];

    // Test with management key - full Node access including /config
    test_user_endpoints(&client, &base_url, test_mgmt_key, true, true).await;
    test_node_endpoints(
        &client,
        &base_url,
        test_mgmt_key,
        true,
        manager_overrides,
    )
    .await;
    test_admin_users_endpoints(&client, &base_url, test_mgmt_key, false).await; // Should NOT have access
    test_admin_roles_endpoints(&client, &base_url, test_mgmt_key, false, false)
        .await; // Should NOT have access
    test_admin_apikeys_endpoints(
        &client,
        &base_url,
        test_mgmt_key,
        false,
        false,
    )
    .await; // Should NOT have access
    test_admin_system_endpoints(&client, &base_url, test_mgmt_key, false).await; // Should NOT have access

    // Test with service key
    test_user_endpoints(&client, &base_url, test_service_key, true, false)
        .await;
    test_node_endpoints(
        &client,
        &base_url,
        test_service_key,
        true,
        manager_overrides,
    )
    .await;
    test_admin_users_endpoints(&client, &base_url, test_service_key, false)
        .await; // Should NOT have access
    test_admin_roles_endpoints(
        &client,
        &base_url,
        test_service_key,
        false,
        false,
    )
    .await; // Should NOT have access
    test_admin_apikeys_endpoints(
        &client,
        &base_url,
        test_service_key,
        false,
        false,
    )
    .await; // Should NOT have access
    test_admin_system_endpoints(&client, &base_url, test_service_key, false)
        .await; // Should NOT have access
}

#[test(tokio::test)]
async fn test_data_role_endpoints_access() {
    let Some((server, _dirs)) =
        common::TestServer::build(true, false, None).await
    else {
        return;
    };
    let client = Client::new();
    let base_url = server.url("");

    // Login as default admin to create test user
    let login_response: serde_json::Value = client
        .post(&server.url("/login"))
        .json(&json!({"username": "admin", "password": "AdminPass123!"}))
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    let admin_api_key = login_response["api_key"].as_str().unwrap();

    // Get Data role ID
    let roles_response: serde_json::Value = client
        .get(&server.url("/admin/roles"))
        .header("X-API-Key", admin_api_key)
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    let data_role_id = roles_response
        .as_array()
        .unwrap()
        .iter()
        .find(|r| r["name"] == "data")
        .unwrap()["id"]
        .as_i64()
        .unwrap();

    // Create test user with Data role via HTTP
    let _create_user_response: serde_json::Value = client
        .post(&server.url("/admin/users"))
        .header("X-API-Key", admin_api_key)
        .json(&json!({
            "username": "test_data_user",
            "password": "TestPass123!",
            "is_superadmin": false,
            "role_ids": [data_role_id],
            "must_change_password": false
        }))
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    // Login as test data user to get management key
    let test_login_response: serde_json::Value = client
        .post(&server.url("/login"))
        .json(
            &json!({"username": "test_data_user", "password": "TestPass123!"}),
        )
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    let test_mgmt_key = test_login_response["api_key"].as_str().unwrap();

    // Create service key via /me/api-keys
    let service_key_response: serde_json::Value = client
        .post(&server.url("/me/api-keys"))
        .header("X-API-Key", test_mgmt_key)
        .json(&json!({
            "name": "service_key",
            "is_management": false
        }))
        .send()
        .await
        .unwrap()
        .json()
        .await
        .unwrap();

    let test_service_key = service_key_response["api_key"].as_str().unwrap();

    // Data should have access to:
    // - User resources (all actions)
    // - Node-Request (get only - read-only)
    // - Node-Subject (get only - read-only)
    // - Node-System (get only - read-only)
    // But NOT to Node-Keys or Admin-* resources

    let data_read_access = [
        // node_system:get
        ("get", "/public-key", true),
        ("get", "/peer-id", true),
        ("get", "/network-state", true),
        // /config requires node_management:get - data does NOT have it
        // node_subject:get
        ("get", "/state/{subject_id}", true),
        ("get", "/events/{subject_id}", true),
        ("get", "/events/{subject_id}/{sn}", true),
        ("get", "/events-first-last/{subject_id}", true),
        ("get", "/aborts/{subject_id}", true),
        ("get", "/subjects", true),
        ("get", "/subjects/{governance_id}", true),
        ("get", "/approval", true),
        ("get", "/approval/{subject_id}", true),
        ("get", "/auth", true),
        ("get", "/auth/{subject_id}", true),
        ("get", "/pending-transfers", true),
        // node_request:get
        ("get", "/request", true),
        ("get", "/request/{request_id}", true),
        ("get", "/requests-in-manager", true),
        ("get", "/requests-in-manager/{subject_id}", true),
    ];

    // Test with management key - read-only Node access
    test_user_endpoints(&client, &base_url, test_mgmt_key, true, true).await;
    test_node_endpoints(
        &client,
        &base_url,
        test_mgmt_key,
        false,
        &data_read_access,
    )
    .await; // Read-only node/system access
    test_admin_users_endpoints(&client, &base_url, test_mgmt_key, false).await; // Should NOT have access
    test_admin_roles_endpoints(&client, &base_url, test_mgmt_key, false, false)
        .await; // Should NOT have access
    test_admin_apikeys_endpoints(
        &client,
        &base_url,
        test_mgmt_key,
        false,
        false,
    )
    .await; // Should NOT have access
    test_admin_system_endpoints(&client, &base_url, test_mgmt_key, false).await; // Should NOT have access

    // Test with service key
    test_user_endpoints(&client, &base_url, test_service_key, true, false)
        .await;
    test_node_endpoints(
        &client,
        &base_url,
        test_service_key,
        false,
        &data_read_access,
    )
    .await; // Read-only node/system access
    test_admin_users_endpoints(&client, &base_url, test_service_key, false)
        .await; // Should NOT have access
    test_admin_roles_endpoints(
        &client,
        &base_url,
        test_service_key,
        false,
        false,
    )
    .await; // Should NOT have access
    test_admin_apikeys_endpoints(
        &client,
        &base_url,
        test_service_key,
        false,
        false,
    )
    .await; // Should NOT have access
    test_admin_system_endpoints(&client, &base_url, test_service_key, false)
        .await; // Should NOT have access
}

#[test]
fn role_tests_cover_all_protected_http_route_catalogs() {
    let mut covered = node_routes();
    covered.extend(user_routes());
    covered.extend(user_api_key_routes());
    covered.extend(admin_users_routes());
    covered.extend(admin_roles_routes());
    covered.extend(admin_apikey_routes());
    covered.extend(admin_system_routes());

    let mut catalog = server_main_route_catalog();
    catalog.extend(server_auth_route_catalog());

    let missing: Vec<_> = catalog.difference(&covered).cloned().collect();
    let stale: Vec<_> = covered.difference(&catalog).cloned().collect();

    assert!(
        missing.is_empty() && stale.is_empty(),
        "Role test route matrix is out of sync with protected HTTP route catalogs. Missing: {missing:?}. Stale: {stale:?}"
    );
}