const assert = require("node:assert/strict");
const fs = require("node:fs");
const path = require("node:path");

const root = path.resolve(__dirname, "..");
const read = (file) => fs.readFileSync(path.join(root, file), "utf8");

const assistant = read("src/components/xingbang/BusinessAssistant.tsx");
const message = read("src/components/chat/ChatMessage.tsx");
const coreProxy = read("src/app/api/core/[...path]/route.ts");

assert.match(
  assistant,
  /setNativeAccess\(body\.identity\?\.role==="admin"&&!!sessionStorage\.getItem\("xingbang-access-token"\)\)/,
  "只有带正式令牌的管理员才能进入原版通用工具工作台",
);
assert.match(
  assistant,
  /nativeAccess\?<AppProvider><ChatPanel\/><\/AppProvider>:conversation/,
  "客户经理和评审员应回落到受角色约束的项目会话，而不是请求管理员接口",
);
assert.match(
  assistant,
  /当前身份只会调用本项目授权的 Skills、规则和业务工具/,
  "受限工作台应明确说明权限边界",
);
assert.match(
  message,
  /authentication\.\?fail[\s\S]*return "provider";[\s\S]*\/401\|unauthorized[\s\S]*return "identity";/,
  "401 身份错误不能继续误报为模型 API Key 失败",
);
assert.match(
  coreProxy,
  /user\.role !== "admin"/,
  "修复不得放开原版终端、文件和网页工具的管理员边界",
);

console.log("Cloud mini-openclaw role access checks passed");