/**
 * Layer 1: Unit Test - FirebaseAuthTool Admin Recognition with Missing Email
 *
 * These tests verify the UID-based fallback added to FirebaseAuthTool so that
 * admin users without an email claim are still recognized as admins.
 */

import { describe, it, expect, beforeEach, afterEach } from '@jest/globals';

import { FirebaseAuthTool } from '../FirebaseAuthTool.js';
import type { User } from '../types.js';

const ADMIN_UID = 'UlET1VDO7ORksFiAPQ2b9jI9K9t1';

const buildMockAdminUser = (overrides: Partial<User> = {}): User => ({
  id: ADMIN_UID,
  uid: ADMIN_UID,
  email: '',
  name: 'Admin Missing Email',
  isAuthenticated: true,
  ...overrides
});

const buildTestTokenMap = (): Record<string, { uid: string; email?: string; name?: string }> => ({
  'test-token-admin-no-email': {
    uid: ADMIN_UID,
    name: 'Admin Missing Email',
    email: ''
  },
  'test-token-admin-with-email': {
    uid: ADMIN_UID,
    email: 'jleechan@gmail.com',
    name: 'Admin Email Present'
  }
});

describe('FirebaseAuthTool - Admin Recognition with Missing Email', () => {
  const resetEnv = (): void => {
    delete process.env.FIREBASE_ADMIN_UIDS;
    delete process.env.FIREBASE_TEST_TOKEN_MAP;
    delete process.env.FIREBASE_ADMIN_EMAILS;
    delete process.env.AI_UNIVERSE_FIREBASE_PROJECT_ID;
    delete process.env.ALLOW_TEST_FIREBASE_TOKENS;
    delete process.env.NODE_ENV;
  };

  beforeEach(() => {
    process.env.AI_UNIVERSE_FIREBASE_PROJECT_ID = 'test-firebase-project';
    process.env.NODE_ENV = 'test';
    process.env.ALLOW_TEST_FIREBASE_TOKENS = 'true';
    process.env.FIREBASE_ADMIN_EMAILS = 'jleechan@gmail.com,admin@example.com';
    process.env.FIREBASE_ADMIN_UIDS = ADMIN_UID;
    process.env.FIREBASE_TEST_TOKEN_MAP = JSON.stringify(buildTestTokenMap());
  });

  afterEach(() => {
    resetEnv();
  });

  it('recognizes admin via UID fallback when email claim is missing', () => {
    const authTool = new FirebaseAuthTool();
    const user = buildMockAdminUser();

    expect(authTool.isAdmin(user)).toBe(true);
  });

  it('does not escalate when UID fallback is not configured', () => {
    process.env.FIREBASE_ADMIN_UIDS = '';
    const authTool = new FirebaseAuthTool();
    const user = buildMockAdminUser();

    expect(authTool.isAdmin(user)).toBe(false);
  });

  it('keeps unauthenticated users as non-admin even if UID matches', () => {
    const authTool = new FirebaseAuthTool();
    const unauthenticated = buildMockAdminUser({ isAuthenticated: false });

    expect(authTool.isAdmin(unauthenticated)).toBe(false);
  });

  it('verifyIdToken resolves tokens without email claim and enables UID fallback', async () => {
    const authTool = new FirebaseAuthTool();
    const user = await authTool.verifyIdToken('test-token-admin-no-email');

    expect(user.email).toBe('');
    expect(user.uid).toBe(ADMIN_UID);
    expect(authTool.isAdmin(user)).toBe(true);
  });
});