"""RBAC 权限号段一致性（只读，不连库）。

规则与动机见 `tools/check_rbac_seed_consistency.py` 的模块说明：权限码的定义源是
`tools/seed_test_rbac.py` 的 `PERMISSIONS`，各 `grant_*.py` 只能补种子里缺的，
且 id 必须与种子逐条一致 —— 2026-09-12 曾因两套 id→code 映射并存，
让 `advisor` 角色在种子重建后静默拿到语义错误的权限。
"""

from __future__ import annotations

import importlib.util
from pathlib import Path
from types import ModuleType

PROJECT_ROOT = Path(__file__).resolve().parents[3]


def _load_tool_module() -> ModuleType:
    path = PROJECT_ROOT / "tools" / "check_rbac_seed_consistency.py"
    spec = importlib.util.spec_from_file_location("check_rbac_seed_consistency", path)
    assert spec is not None and spec.loader is not None
    module = importlib.util.module_from_spec(spec)
    spec.loader.exec_module(module)
    return module


def test_permission_ids_are_consistent_between_seed_and_grant_scripts() -> None:
    problems = _load_tool_module().collect_findings()
    assert problems == [], "权限号段不一致：\n" + "\n".join(problems)