import { describe, expect, it } from "@suaveplan/testing/runner";
import {
    SECRETS_VAULT_CODES,
    SecretsVaultError,
} from "../error-codes/error-codes.js";
import { createAllowlist } from "./allowlist.js";

describe("createAllowlist", () => {
    it("rejects non-string names with INVALID_OPTIONS", {
        timeout: 5000,
    }, () => {
        let caught: unknown;
        try {
            const bad = 123 as unknown;
            createAllowlist({ names: [bad as string] });
        } catch (err) {
            caught = err;
        }
        expect(caught).toBeInstanceOf(SecretsVaultError);
        expect((caught as SecretsVaultError).code).toBe(
            SECRETS_VAULT_CODES.INVALID_OPTIONS
        );
    });

    it("rejects empty-string entries", { timeout: 5000 }, () => {
        let caught: unknown;
        try {
            createAllowlist({ names: ["A", ""] });
        } catch (err) {
            caught = err;
        }
        expect(caught).toBeInstanceOf(SecretsVaultError);
    });

    it("accepts an empty list", { timeout: 5000 }, () => {
        const allow = createAllowlist({ names: [] });
        expect(allow.names).toEqual([]);
        expect(allow.isAllowed("anything")).toBe(false);
    });

    it("deduplicates and sorts names", { timeout: 5000 }, () => {
        const allow = createAllowlist({ names: ["B", "A", "B", "A"] });
        expect(allow.names).toEqual(["A", "B"]);
    });

    it("isAllowed is true for in-list names", { timeout: 5000 }, () => {
        const allow = createAllowlist({ names: ["STRIPE"] });
        expect(allow.isAllowed("STRIPE")).toBe(true);
        expect(allow.isAllowed("AWS")).toBe(false);
    });

    it("assertAllowed raises NOT_ALLOWED with the name in context", {
        timeout: 5000,
    }, () => {
        const allow = createAllowlist({ names: ["STRIPE"] });
        let caught: unknown;
        try {
            allow.assertAllowed("AWS");
        } catch (err) {
            caught = err;
        }
        expect(caught).toBeInstanceOf(SecretsVaultError);
        expect((caught as SecretsVaultError).code).toBe(
            SECRETS_VAULT_CODES.NOT_ALLOWED
        );
        expect((caught as SecretsVaultError).context).toEqual({
            name: "AWS",
        });
    });

    it("un-manifested read raises SECRETS_VAULT_NOT_ALLOWED", {
        timeout: 5000,
    }, () => {
        const allow = createAllowlist({ names: ["STRIPE"] });
        expect(() => allow.assertAllowed("AWS")).toThrow(SecretsVaultError);
    });

    it("names array is frozen", { timeout: 5000 }, () => {
        const allow = createAllowlist({ names: ["A"] });
        expect(Object.isFrozen(allow.names)).toBe(true);
    });
});