import { describe, expect, it } from 'vitest'
import { canApproveAccess, hasAccess, realmRolesFromPayload, rolesFromPayload } from './auth.js'

describe('FieldLens authorization isolation', () => {
  it('extracts FieldLens client roles and ignores realm/platform roles for app access', () => {
    const payload = {
      resource_access: {
        'fieldlens-api': { roles: ['fieldlens-operator'] },
      },
      realm_access: { roles: ['operator', 'admin', 'owner', 'offline_access'] },
    }
    expect(rolesFromPayload(payload)).toEqual(['fieldlens-operator'])
    expect(realmRolesFromPayload(payload)).toEqual(['operator', 'admin', 'owner', 'offline_access'])
  })

  it('does not grant FieldLens operational access from generic Arrowstack roles', () => {
    const platformIdentity = {
      roles: ['operator', 'admin', 'owner'],
      realmRoles: ['operator', 'admin', 'owner'],
      clientId: 'some-arrowstack-client',
    }

    expect(hasAccess('operator', platformIdentity)).toBe(false)
    expect(hasAccess('supervisor', platformIdentity)).toBe(false)
    expect(hasAccess('admin', platformIdentity)).toBe(false)
    expect(hasAccess('integration', platformIdentity)).toBe(false)
  })

  it('allows only admin/owner realm identities to approve access without granting app access', () => {
    expect(canApproveAccess({ roles: [], realmRoles: ['admin'] })).toBe(true)
    expect(canApproveAccess({ roles: [], realmRoles: ['owner'] })).toBe(true)
    expect(canApproveAccess({ roles: [], realmRoles: ['operator'] })).toBe(false)
    expect(hasAccess('operator', { roles: [], clientId: 'fieldlens' })).toBe(false)
  })

  it('preserves the FieldLens role hierarchy', () => {
    expect(hasAccess('operator', { roles: ['fieldlens-operator'] })).toBe(true)
    expect(hasAccess('operator', { roles: ['fieldlens-supervisor'] })).toBe(true)
    expect(hasAccess('supervisor', { roles: ['fieldlens-admin'] })).toBe(true)
    expect(hasAccess('admin', { roles: ['fieldlens-admin'] })).toBe(true)
    expect(hasAccess('admin', { roles: ['fieldlens-supervisor'] })).toBe(false)
  })
})