<?php

/**
 * Guard for AdminGroup default permissions — catches silent regressions that
 * would break the API upgrade endpoint for admin groups with NULL permissions.
 *
 * Why this test exists:
 *   POST /api/v1/upgrade/{run,finalize} gates on
 *   `Admin->getPermission('setting_upgrade_manager') === 'yes'`.
 *   When `admin_groups.permissions` is NULL (fresh install or legacy row),
 *   AdminGroup::getPermission() falls back to defaultPermissions().
 *   If that default flips back to 'no', upgrade API silently returns 401 and
 *   support engineers get stuck doing SSH — which is exactly what we shipped
 *   the API endpoint to avoid.
 */

use App\Model\AdminGroup;

uses(\Tests\TestCase::class);

it('grants setting_upgrade_manager=yes by default so API upgrade works on fresh installs', function () {
    $perms = AdminGroup::defaultPermissions();
    expect($perms)
        ->toHaveKey('setting_upgrade_manager')
        ->and($perms['setting_upgrade_manager'])->toBe('yes');
});

it('grants setting_general=yes by default so license refresh API works', function () {
    $perms = AdminGroup::defaultPermissions();
    expect($perms['setting_general'])->toBe('yes');
});