import { strict as assert } from 'node:assert';
import { describe, it } from 'node:test';
import type { Principal } from '../src/lib/auth';
import { AuthError, effectivePermissions, requireCapability } from '../src/lib/auth';

function principal(overrides: Partial<Principal> = {}): Principal {
  return {
    userId: '00000000-0000-0000-0000-000000000001',
    email: 'seller@example.com',
    name: 'Seller',
    isPlatformAdmin: false,
    teams: [{ team: 'demand', role: 'member' }],
    via: 'jwt',
    scopes: ['read', 'write'],
    ...overrides,
  };
}

describe('capability enforcement', () => {
  it('rejects a role grant from the wrong team', () => {
    assert.throws(
      () => requireCapability(principal(), 'deal:write', 'supply'),
      (error: unknown) => error instanceof AuthError && error.code === 'insufficient_permission',
    );
  });

  it('removes write grants from a read-only API key', () => {
    const readOnly = principal({ via: 'api_key', scopes: ['read'] });

    assert.deepEqual(effectivePermissions(readOnly), []);
    assert.throws(
      () => requireCapability(readOnly, 'deal:write', 'demand'),
      (error: unknown) => error instanceof AuthError && error.code === 'insufficient_scope',
    );
  });
});