import { afterEach, describe, expect, it, vi } from "vitest";
import { configuredAdminAuthorities, configuredAdminUsers, hasAdminAccess } from "@/lib/auth/permissions";
import type { AuthUser } from "@/lib/auth/session";

const baseUser: AuthUser = {
  id: "auth:app:1",
  subject: "user-1",
  username: "user-1",
  displayName: "用户1",
  clientId: "app",
  authorities: [],
  scope: ["server"]
};

describe("auth permission helpers", () => {
  afterEach(() => {
    vi.unstubAllEnvs();
  });

  it("treats ordinary users as non-admin", () => {
    expect(hasAdminAccess({ ...baseUser, authorities: ["ROLE_USER"] })).toBe(false);
  });

  it("treats ceshiop as the default administrator account", () => {
    expect(configuredAdminUsers()).toEqual(["ceshiop"]);
    expect(hasAdminAccess({ ...baseUser, username: "ceshiop", subject: "ceshiop", authorities: [] })).toBe(true);
  });

  it("allows configured admin usernames to override the default account", () => {
    vi.stubEnv("ZHINIAN_ADMIN_USERS", "ops-admin");
    expect(configuredAdminUsers()).toEqual(["ops-admin"]);
    expect(hasAdminAccess({ ...baseUser, username: "ceshiop", subject: "ceshiop", authorities: [] })).toBe(false);
    expect(hasAdminAccess({ ...baseUser, username: "ops-admin", subject: "ops-admin", authorities: [] })).toBe(true);
  });

  it("accepts configured admin authorities and normalizes case", () => {
    vi.stubEnv("ZHINIAN_ADMIN_AUTHORITIES", "custom-admin, sys_config_view");
    expect(configuredAdminAuthorities()).toEqual(["custom-admin", "sys_config_view"]);
    expect(hasAdminAccess({ ...baseUser, authorities: ["CUSTOM_ADMIN"] })).toBe(true);
  });

  it("accepts known system admin permission prefixes", () => {
    expect(hasAdminAccess({ ...baseUser, authorities: ["sys_user_view"] })).toBe(true);
    expect(hasAdminAccess({ ...baseUser, authorities: ["admin:accounts"] })).toBe(true);
  });
});