package rbac

import (
	"testing"
)

func BenchmarkCan(b *testing.B) {
	r := New()
	r.DefineRole(Role{Name: "admin", ModuleGrants: map[string][]Permission{"*": {"*"}}})
	r.DefineRole(Role{Name: "viewer", ModuleGrants: map[string][]Permission{
		"system":   {"read"},
		"services": {"read"},
		"audit":    {"read"},
	}})
	r.DefineRole(Role{Name: "operator", ModuleGrants: map[string][]Permission{
		"system":   {"read", "root"},
		"services": {"read", "write"},
	}})

	r.AssignRole("alice", "admin")
	r.AssignRole("bob", "viewer")
	r.AssignRole("charlie", "viewer")
	r.AssignRole("charlie", "operator")

	// b.Loop automatically excludes the setup above from timing (no ResetTimer
	// needed) and keeps the calls from being optimised away.
	for b.Loop() {
		_ = r.Can("charlie", "services", "write")
		_ = r.Can("bob", "system", "root")
		_ = r.Can("alice", "audit", "write")
	}
}