import { describe, expect, it } from 'vitest'
import { hasAccess, rolesFromPayload } from './auth.js'

describe('FieldLens authorization isolation', () => {
  it('extracts FieldLens client roles and ignores realm/platform roles', () => {
    const roles = rolesFromPayload({
      resource_access: {
        'fieldlens-api': { roles: ['fieldlens-operator'] },
      },
      realm_access: { roles: ['operator', 'admin', 'owner', 'offline_access'] },
    })

    expect(roles).toEqual(['fieldlens-operator'])
  })

  it('does not grant FieldLens access from generic Arrowstack roles', () => {
    const platformIdentity = {
      roles: ['operator', 'admin', 'owner'],
      clientId: 'some-arrowstack-client',
    }

    expect(hasAccess('operator', platformIdentity)).toBe(false)
    expect(hasAccess('supervisor', platformIdentity)).toBe(false)
    expect(hasAccess('admin', platformIdentity)).toBe(false)
    expect(hasAccess('integration', platformIdentity)).toBe(false)
  })

  it('preserves the FieldLens role hierarchy', () => {
    expect(hasAccess('operator', { roles: ['fieldlens-operator'] })).toBe(true)
    expect(hasAccess('operator', { roles: ['fieldlens-supervisor'] })).toBe(true)
    expect(hasAccess('supervisor', { roles: ['fieldlens-admin'] })).toBe(true)
    expect(hasAccess('admin', { roles: ['fieldlens-admin'] })).toBe(true)
    expect(hasAccess('admin', { roles: ['fieldlens-supervisor'] })).toBe(false)
  })
})