// @vitest-environment node
// Runs in the Node environment (not happy-dom) because the WHATWG `Request`
// in happy-dom strips the `cookie` header on construction (browsers forbid
// setting it from script). Server-side identity tests need the real Node
// `Request`, which preserves arbitrary headers.

import { describe, expect, it } from "vitest";
import { app, SEEDED } from "./runtime.ts";

// Sample test demonstrating how to test app code against the framework's
// port contracts. The composition root provides the wired ports; tests
// drive them directly. For deeper testing of your own custom adapters,
// import the framework's conformance harnesses (e.g.
// `identityProviderConformance` from `@raredays/identity/testing`) and
// pass your factory.

describe("identity flow (in-memory provider)", () => {
  it("resolves the seeded session when the dev cookie is present", async () => {
    const provider = app.require("identityProvider");
    const req = new Request("https://example.com/", {
      headers: { cookie: `rd-dev-session=${SEEDED.sessionId}` },
    });
    const session = await provider.getSession(req);
    expect(session).not.toBeNull();
    expect(session?.user.id).toBe(SEEDED.user.id);
  });

  it("returns null when no session cookie is present", async () => {
    const provider = app.require("identityProvider");
    const session = await provider.getSession(new Request("https://example.com/"));
    expect(session).toBeNull();
  });
});

describe("permissions (in-memory permission port)", () => {
  it("seeded user has content.read but not content.manage", async () => {
    const permissions = app.require("permissionProvider");
    const { user } = SEEDED;
    await expect(
      permissions.hasPermission(user, "content", "read", user.organizationId),
    ).resolves.toBe(true);
    await expect(
      permissions.hasPermission(user, "content", "manage", user.organizationId),
    ).resolves.toBe(false);
  });
});