1 files changed, 61 insertions, 0 deletions
diff --git a/weed/s3api/s3_iam_role_selection_test.go b/weed/s3api/s3_iam_role_selection_test.go
new file mode 100644
index 000000000..91b1f2822
--- /dev/null
+++ b/weed/s3api/s3_iam_role_selection_test.go
@@ -0,0 +1,61 @@
+package s3api
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/iam/providers"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSelectPrimaryRole(t *testing.T) {
+	s3iam := &S3IAMIntegration{}
+
+	t.Run("empty_roles_returns_empty", func(t *testing.T) {
+		identity := &providers.ExternalIdentity{Attributes: make(map[string]string)}
+		result := s3iam.selectPrimaryRole([]string{}, identity)
+		assert.Equal(t, "", result)
+	})
+
+	t.Run("single_role_returns_that_role", func(t *testing.T) {
+		identity := &providers.ExternalIdentity{Attributes: make(map[string]string)}
+		result := s3iam.selectPrimaryRole([]string{"admin"}, identity)
+		assert.Equal(t, "admin", result)
+	})
+
+	t.Run("multiple_roles_returns_first", func(t *testing.T) {
+		identity := &providers.ExternalIdentity{Attributes: make(map[string]string)}
+		roles := []string{"viewer", "manager", "admin"}
+		result := s3iam.selectPrimaryRole(roles, identity)
+		assert.Equal(t, "viewer", result, "Should return first role")
+	})
+
+	t.Run("order_matters", func(t *testing.T) {
+		identity := &providers.ExternalIdentity{Attributes: make(map[string]string)}
+
+		// Test different orderings
+		roles1 := []string{"admin", "viewer", "manager"}
+		result1 := s3iam.selectPrimaryRole(roles1, identity)
+		assert.Equal(t, "admin", result1)
+
+		roles2 := []string{"viewer", "admin", "manager"}
+		result2 := s3iam.selectPrimaryRole(roles2, identity)
+		assert.Equal(t, "viewer", result2)
+
+		roles3 := []string{"manager", "admin", "viewer"}
+		result3 := s3iam.selectPrimaryRole(roles3, identity)
+		assert.Equal(t, "manager", result3)
+	})
+
+	t.Run("complex_enterprise_roles", func(t *testing.T) {
+		identity := &providers.ExternalIdentity{Attributes: make(map[string]string)}
+		roles := []string{
+			"finance-readonly",
+			"hr-manager",
+			"it-system-admin",
+			"guest-viewer",
+		}
+		result := s3iam.selectPrimaryRole(roles, identity)
+		// Should return the first role
+		assert.Equal(t, "finance-readonly", result, "Should return first role in list")
+	})
+}