const {checkPermission}=require("../../app/middleware/permission.middleware");
describe("Phase 5 permission boundaries",()=>{test("denies an authenticated customer without inventory permission",()=>{const req={user:{accountType:"CUSTOMER",permissions:[]},method:"POST"},res={status:jest.fn().mockReturnThis(),json:jest.fn()},next=jest.fn();checkPermission("inventory.adjust",{custom:true})(req,res,next);expect(res.status).toHaveBeenCalledWith(403);expect(next).not.toHaveBeenCalled();});test("allows explicit permission",()=>{const req={user:{accountType:"ADMIN",permissions:["pricing.business.manage"]},method:"POST"},res={},next=jest.fn();checkPermission("pricing.business.manage",{custom:true})(req,res,next);expect(next).toHaveBeenCalled();});});