"""Regression: every ``UserRole`` must have either a seeded Django Group
permission OR a reference in a known role-gate file. If anyone lands a new
role in ``apps.core.permissions.roles.UserRole`` without wiring it, this
test fails — forcing them to either gate it or document the descope.
"""
from __future__ import annotations

import pytest

from apps.core.management.commands.audit_roles import audit
from apps.core.permissions.roles import UserRole


@pytest.mark.django_db
def test_every_role_has_a_gate():
    rows, uncovered = audit()
    # Sanity: matrix has one row per role.
    assert len(rows) == len(list(UserRole))
    assert uncovered == [], (
        "Roles without any access gate: " + ", ".join(uncovered)
        + ". Add Django Group permissions in apps/core/management/commands/seed_roles.py "
        "OR reference the role in apps/**/role_gates.py / apps/**/permissions/mixins.py."
    )