Feature: RBAC Manual Test Plan Coverage

  Scenario: Test plan provides complete resource coverage
    Given the manual test plan document
    When I review the coverage matrix
    Then I should see test cases for all resource types:
      | Resource Type |
      | Tools         |
      | Resources     |
      | Prompts       |
      | Servers       |
      | Gateways      |
      | A2A Agents    |
    And each resource type should have visibility tests (private, team, public)
    And each test case should have clear preconditions
    And each test case should have step-by-step procedures
    And each test case should have expected results

  Scenario: Test plan is reproducible by any tester
    Given a tester with database access
    When the tester follows the setup instructions
    Then the preconditions should be established within 15 minutes
    And each test case should be executable independently
    And results should be deterministic and repeatable

Feature: Token Type Access Control

  Scenario Outline: Admin token grants unrestricted access
    Given an admin token with is_admin=true and teams=null
    And a <visibility> resource owned by another user
    When I access the resource with the admin token
    Then the request should return status <status>
    And the response should contain the resource data

    Examples:
      | visibility | status |
      | private    | 200    |
      | team       | 200    |
      | public     | 200    |

  Scenario: Team-scoped token restricts to team resources
    Given a team-scoped token with teams=["team-alpha"]
    And a team-visible resource in "team-alpha"
    And a team-visible resource in "team-beta"
    When I list resources with the team-scoped token
    Then I should see the "team-alpha" resource
    And I should NOT see the "team-beta" resource

  Scenario: Public-only token cannot access private resources
    Given a public-only token with teams=[]
    And a private resource owned by the token's user
    When I access the private resource
    Then the request should return status 403
    And the response should contain "Access denied"

  Scenario: Public-only token can access public resources
    Given a public-only token with teams=[]
    And a public resource in any team
    When I access the public resource
    Then the request should return status 200

Feature: MCP Authentication Modes

  Scenario: Permissive mode allows unauthenticated public access
    Given MCP_REQUIRE_AUTH=false (permissive mode)
    And a public tool exists
    And a team-visible tool exists
    When I invoke tools/list without authentication
    Then I should receive the public tool
    And I should NOT receive the team-visible tool
    And the response should NOT contain private tools

  Scenario: Permissive mode blocks unauthenticated team access
    Given MCP_REQUIRE_AUTH=false (permissive mode)
    And a team-visible resource exists
    When I attempt to access the team resource without authentication
    Then the request should return status 403
    And the response should indicate "Authentication required for team resources"

  Scenario: Strict mode blocks all unauthenticated access
    Given MCP_REQUIRE_AUTH=true (strict mode)
    And a public tool exists
    When I invoke tools/list without authentication
    Then the request should return status 401
    And the response should indicate "Authentication required"

  Scenario: Authenticated user in permissive mode gets full RBAC
    Given MCP_REQUIRE_AUTH=false (permissive mode)
    And a valid JWT token for a team member
    When I invoke tools/list with the token
    Then I should receive public tools
    And I should receive team-visible tools for my teams
    And I should receive my private tools

Feature: Visibility vs Ownership

  Scenario: Private visibility restricts to owner only
    Given User A owns a private resource in Team T
    And User B is a member of Team T
    When User B attempts to access the private resource
    Then the request should return status 403
    And only User A should be able to access the resource

  Scenario: Team visibility allows all team members
    Given User A owns a team-visible resource in Team T
    And User B is a member of Team T
    And User C is NOT a member of Team T
    When User B accesses the resource
    Then the request should return status 200
    When User C attempts to access the resource
    Then the request should return status 403

  Scenario: Public visibility allows all authenticated users
    Given User A owns a public resource in Team T
    And User D is authenticated but not in Team T
    When User D accesses the resource
    Then the request should return status 200
    And the response should contain the resource data

  Scenario: Resource belongs to team but visibility controls access
    Given a public resource belongs to Team T (team_id=T)
    And User B is NOT a member of Team T
    When User B accesses the resource
    Then the request should return status 200
    And the resource's team_id should still show Team T

Feature: Team Filter Behavior

  Scenario: Team filter shows only resources belonging to that team
    Given User A is a member of Team T and Team X
    And Team T has: Tool-T1 (team), Tool-T2 (public)
    And Team X has: Tool-X1 (public)
    When User A lists tools with team_id=T
    Then the response should contain Tool-T1 and Tool-T2
    And the response should NOT contain Tool-X1
    And public resources from other teams are excluded

  Scenario: Team filter respects visibility within the team
    Given User A is a member of Team T
    And Team T has:
      | Resource    | Visibility | Owner  |
      | Private-A   | private    | User A |
      | Private-B   | private    | User B |
      | Team-Tool   | team       | User B |
      | Public-Tool | public     | User B |
    When User A lists tools with team_id=T
    Then the response should contain: Private-A, Team-Tool, Public-Tool
    And the response should NOT contain: Private-B

  Scenario: Non-member cannot filter by team they don't belong to
    Given User C is NOT a member of Team T
    When User C lists resources with team_id=T
    Then the response should return an empty list
    And no resources from Team T should be visible

Feature: Token Scope Intersection with RBAC

  Scenario: Token permissions restrict RBAC grants
    Given RBAC grants User A tools.execute permission
    And User A's token has permissions=["tools.read"]
    When User A attempts to execute a tool
    Then the request should return status 403
    And the denial should cite "Token scope insufficient"

  Scenario: RBAC denial overrides token grants
    Given RBAC denies User B prompts.delete permission
    And User B's token has permissions=["prompts.*"]
    When User B attempts to delete a prompt
    Then the request should return status 403
    And the denial should cite "Permission denied"

  Scenario: Token without explicit permissions inherits RBAC
    Given RBAC grants User A resources.read permission
    And User A's token has permissions=null (inherit)
    When User A reads a resource
    Then the request should return status 200

  Scenario: Token server_id scope limits access
    Given a token scoped to server_id="server-1"
    And Tool A belongs to server-1
    And Tool B belongs to server-2
    When the token holder lists tools
    Then the response should contain Tool A
    And the response should NOT contain Tool B

Feature: Ownership CRUD Rules

  Scenario: Owner can update their private resource
    Given User A owns a private tool
    When User A updates the tool description
    Then the request should return status 200
    And the tool should reflect the updated description

  Scenario: Owner can delete their private resource
    Given User A owns a private prompt
    When User A deletes the prompt
    Then the request should return status 200
    And the prompt should no longer exist

  Scenario: Non-owner cannot update private resource
    Given User A owns a private resource in Team T
    And User B is a member of Team T (not owner)
    When User B attempts to update the resource
    Then the request should return status 403

  Scenario: Team owner can update team-visible resources
    Given User A is an owner of Team T
    And User B created a team-visible tool in Team T
    When User A updates the tool
    Then the request should return status 200
    And team owners have management rights over team resources

  Scenario: Team member can update their own creations
    Given User B is a member (not owner) of Team T
    And User B created a team-visible resource
    When User B updates their resource
    Then the request should return status 200