import { describe, expect, it } from 'vitest'
import {
  canAccessAdmin,
  canAccessByPolicy,
  canAccessPlugin,
  getAccessAudience,
  hasAllPermissions,
  hasAnyPermission,
  isAdminUser,
} from '../../permissions'

describe('permission helpers', () => {
  const member = {
    role: 'member',
    role_obj: {
      slug: 'member',
      permissions: ['experiments.view', 'plugins.configure'],
      plugin_access: ['dose'],
    },
  }

  it('treats the admin role as full access', () => {
    const admin = { role: 'admin' }

    expect(isAdminUser(admin)).toBe(true)
    expect(getAccessAudience(admin)).toBe('admin')
    expect(hasAllPermissions(admin, ['platform.configure'])).toBe(true)
    expect(canAccessAdmin(admin)).toBe(true)
  })

  it('checks role permissions and plugin access for non-admin users', () => {
    expect(isAdminUser(member)).toBe(false)
    expect(getAccessAudience(member)).toBe('user')
    expect(hasAllPermissions(member, ['experiments.view'])).toBe(true)
    expect(hasAllPermissions(member, ['platform.configure'])).toBe(false)
    expect(hasAnyPermission(member, ['platform.configure', 'plugins.configure'])).toBe(true)
    expect(canAccessAdmin(member)).toBe(true)
    expect(canAccessPlugin(member, 'dose')).toBe(true)
    expect(canAccessPlugin(member, 'reports')).toBe(false)
  })

  it.each(['none', '', {}, { dose: true }, 42])(
    'should deny every plugin when plugin_access is malformed (%j)',
    (access) => {
      const user = { role: 'member', role_obj: { slug: 'member', plugin_access: access as never } }

      expect(canAccessPlugin(user, 'dose')).toBe(false)
    },
  )

  it('should allow every plugin when the user is an administrator', () => {
    const admin = { role: 'admin', role_obj: { slug: 'admin', plugin_access: ['dose'] } }

    expect(canAccessPlugin(admin, 'reports')).toBe(true)
  })

  it('allows notice publishers to enter the admin panel', () => {
    const publisher = {
      role: 'notice-publisher',
      role_obj: {
        slug: 'notice-publisher',
        permissions: ['notices.publish'],
      },
    }

    expect(canAccessAdmin(publisher)).toBe(true)
  })

  it('evaluates access policies consistently', () => {
    expect(canAccessByPolicy(member, { visibleFor: 'user' })).toBe(true)
    expect(canAccessByPolicy(member, { visibleFor: 'admin' })).toBe(false)
    expect(canAccessByPolicy(member, { permissions: ['experiments.view'] })).toBe(true)
    expect(canAccessByPolicy(member, { anyPermissions: ['platform.configure', 'plugins.configure'] })).toBe(true)
    expect(canAccessByPolicy(member, { requiresAdmin: true })).toBe(false)
    expect(canAccessByPolicy(member, { plugin: 'reports' })).toBe(false)
  })
})