import { describe, expect, it } from "@suaveplan/testing/runner";
import { PermissionPolicy } from "../../policy/policy.js";
import { checkCapability } from "./capability.js";

const policy = new PermissionPolicy({
    database: {
        required: true,
        schemaVersion: 1,
        tablePrefix: "billing_",
    },
    secrets: [{ name: "STRIPE_SECRET_KEY", required: true }],
    events: {
        publishes: ["billing.invoice.created"],
        subscribes: ["users.profile.updated"],
    },
});

describe("checkCapability — db", () => {
    it("allows query inside declared tablePrefix", {
        timeout: 5000,
    }, () => {
        expect(
            checkCapability(policy, {
                capability: "db",
                table: "billing_invoices",
            })
        ).toEqual({ outcome: "allow" });
    });

    it("db denies queries outside declared tablePrefix", {
        timeout: 5000,
    }, () => {
        expect(
            checkCapability(policy, {
                capability: "db",
                table: "users_account",
            })
        ).toEqual({ outcome: "deny", reason: "table-out-of-scope" });
    });

    it("db denies queries when database manifest absent", {
        timeout: 5000,
    }, () => {
        const empty = new PermissionPolicy({});
        expect(
            checkCapability(empty, { capability: "db", table: "any_table" })
        ).toEqual({ outcome: "deny", reason: "db-not-declared" });
    });
});

describe("checkCapability — secrets", () => {
    it("allows declared name", { timeout: 5000 }, () => {
        expect(
            checkCapability(policy, {
                capability: "secrets",
                name: "STRIPE_SECRET_KEY",
            }).outcome
        ).toBe("allow");
    });

    it("secrets denies undeclared name", { timeout: 5000 }, () => {
        expect(
            checkCapability(policy, {
                capability: "secrets",
                name: "AWS_KEY",
            })
        ).toEqual({ outcome: "deny", reason: "secret-not-declared" });
    });

    it("secrets denies when manifest has no secrets array", {
        timeout: 5000,
    }, () => {
        const empty = new PermissionPolicy({});
        expect(
            checkCapability(empty, {
                capability: "secrets",
                name: "FOO",
            }).outcome
        ).toBe("deny");
    });
});

describe("checkCapability — events", () => {
    it("allows publish of declared topic", { timeout: 5000 }, () => {
        expect(
            checkCapability(policy, {
                capability: "events",
                mode: "publish",
                topic: "billing.invoice.created",
            }).outcome
        ).toBe("allow");
    });

    it("allows subscribe of declared topic", { timeout: 5000 }, () => {
        expect(
            checkCapability(policy, {
                capability: "events",
                mode: "subscribe",
                topic: "users.profile.updated",
            }).outcome
        ).toBe("allow");
    });

    it("events denies publish outside manifest", { timeout: 5000 }, () => {
        expect(
            checkCapability(policy, {
                capability: "events",
                mode: "publish",
                topic: "other.topic",
            })
        ).toEqual({ outcome: "deny", reason: "publish-not-declared" });
    });

    it("events denies subscribe outside manifest", {
        timeout: 5000,
    }, () => {
        expect(
            checkCapability(policy, {
                capability: "events",
                mode: "subscribe",
                topic: "other.topic",
            })
        ).toEqual({ outcome: "deny", reason: "subscribe-not-declared" });
    });

    it("events denies when no events block in manifest", {
        timeout: 5000,
    }, () => {
        const empty = new PermissionPolicy({});
        expect(
            checkCapability(empty, {
                capability: "events",
                mode: "publish",
                topic: "anything",
            }).outcome
        ).toBe("deny");
        expect(
            checkCapability(empty, {
                capability: "events",
                mode: "subscribe",
                topic: "anything",
            }).outcome
        ).toBe("deny");
    });
});