import { afterEach, describe, expect, it, vi } from "vitest";
import {
  configuredAdminAuthorities,
  configuredAdminUsers,
  hasAdminAccess,
  hasAdminSessionAccess
} from "@/lib/auth/permissions";
import type { AuthSession, AuthUser } from "@/lib/auth/session";

const baseUser: AuthUser = {
  id: "auth:app:1",
  subject: "user-1",
  username: "user-1",
  displayName: "用户1",
  clientId: "app",
  authorities: [],
  scope: ["server"]
};

describe("auth permission helpers", () => {
  afterEach(() => {
    vi.unstubAllEnvs();
  });

  it("treats ordinary users as non-admin", () => {
    expect(hasAdminAccess({ ...baseUser, authorities: ["ROLE_USER"] })).toBe(false);
  });

  it("uses the platform role as the single source of browser permissions", () => {
    expect(hasAdminAccess({ ...baseUser, role: "user", authorities: ["ROLE_SUPER_ADMIN"] })).toBe(false);
    expect(hasAdminAccess({ ...baseUser, role: "organization_admin", authorities: [] })).toBe(true);
    expect(hasAdminAccess({ ...baseUser, role: "super_admin", authorities: [] })).toBe(true);
  });

  it("treats ceshiop as the default administrator account", () => {
    expect(configuredAdminUsers()).toEqual(["ceshiop"]);
    expect(hasAdminAccess({ ...baseUser, username: "ceshiop", subject: "ceshiop", authorities: [] })).toBe(true);
  });

  it("allows configured admin usernames to override the default account", () => {
    vi.stubEnv("ZHINIAN_ADMIN_USERS", "ops-admin");
    expect(configuredAdminUsers()).toEqual(["ops-admin"]);
    expect(hasAdminAccess({ ...baseUser, username: "ceshiop", subject: "ceshiop", authorities: [] })).toBe(false);
    expect(hasAdminAccess({ ...baseUser, username: "ops-admin", subject: "ops-admin", authorities: [] })).toBe(true);
    expect(hasAdminAccess({ ...baseUser, displayName: "ops-admin", authorities: [] })).toBe(false);
  });

  it("uses configured admin usernames without granting common platform permissions", () => {
    vi.stubEnv("ZHINIAN_ADMIN_USERS", "admin");
    expect(hasAdminAccess({ ...baseUser, username: "staff", subject: "staff", authorities: ["sys_user_view"] })).toBe(false);
    expect(hasAdminAccess({ ...baseUser, username: "admin", subject: "admin", authorities: [] })).toBe(true);
  });

  it("accepts exact configured admin authorities and normalizes case", () => {
    vi.stubEnv("ZHINIAN_ADMIN_AUTHORITIES", "custom-admin, role_ops_admin");
    expect(configuredAdminAuthorities()).toEqual(["custom-admin", "role_ops_admin"]);
    expect(hasAdminAccess({ ...baseUser, authorities: ["CUSTOM_ADMIN"] })).toBe(true);
    expect(hasAdminAccess({ ...baseUser, authorities: ["CUSTOM_ADMIN_EXTRA"] })).toBe(false);
  });

  it("accepts dedicated admin roles but rejects generic roles and SYS permissions", () => {
    expect(hasAdminAccess({ ...baseUser, authorities: ["ROLE_ADMIN"] })).toBe(true);
    expect(hasAdminAccess({ ...baseUser, authorities: ["SUPER_ADMIN"] })).toBe(true);
    expect(hasAdminAccess({ ...baseUser, authorities: ["ROLE_1"] })).toBe(false);
    expect(hasAdminAccess({ ...baseUser, authorities: ["1"] })).toBe(false);
    expect(hasAdminAccess({ ...baseUser, authorities: ["sys_user_view"] })).toBe(false);
    expect(hasAdminAccess({ ...baseUser, authorities: ["admin:accounts"] })).toBe(false);
  });

  it("requires both admin login mode and an administrator identity", () => {
    const adminUser = { ...baseUser, authorities: ["ROLE_ADMIN"] };
    const session = (authMode: AuthSession["authMode"], user = adminUser): AuthSession => ({
      version: 1,
      authMode,
      issuedAt: 100,
      expiresAt: 200,
      user
    });

    expect(hasAdminSessionAccess(session("user"))).toBe(false);
    expect(hasAdminSessionAccess(session("admin"))).toBe(true);
    expect(hasAdminSessionAccess(session("admin", { ...baseUser, authorities: ["ROLE_USER"] }))).toBe(false);
  });
});