package domain_test

import (
	"git.cin.su/m/Assistant/contracts/identity"
	"git.cin.su/m/Assistant/modules/identity/domain"
	"testing"
)

func TestRealmSeparatesOwnerSharedAndPublicAccess(t *testing.T) {
	r := identity.PrincipalDataRealm{ID: "realm", OwnerPrincipalID: "owner", Kind: identity.DataRealmShared, Shared: true, MemberPrincipalIDs: []identity.PrincipalID{"member"}, Revision: 1, RecordedAtUnixMillis: 1}
	if !domain.CanReadRealm(r, "owner") || !domain.CanReadRealm(r, "member") || domain.CanReadRealm(r, "guest") {
		t.Fatalf("realm access leaked: %+v", r)
	}
}