import { beforeEach, describe, expect, it, vi } from 'vitest';
import { ScopeProvider } from '../scope.provider.js';
function buildProvider(authContext, adminByOwnerId = {}) {
    const authContextProvider = {
        getAuthContext: vi.fn().mockResolvedValue(authContext),
    };
    const loadFn = vi.fn((ownerId) => Promise.resolve(adminByOwnerId[ownerId] ?? null));
    const adminContextProvider = {
        adminContextByOwnerIdLoader: { load: loadFn },
    };
    return {
        provider: new ScopeProvider(authContextProvider, adminContextProvider),
        getAdminContextByOwnerId: loadFn,
    };
}
const authContext = {
    authType: 'jwt',
    tenant: { businessId: 'b-1' },
    memberships: [
        { businessId: 'b-1', roleId: 'owner' },
        { businessId: 'b-2', roleId: 'accountant' },
    ],
    activeReadScope: { businessIds: ['b-1', 'b-2'] },
};
describe('ScopeProvider.getReadScope', () => {
    it('defaults to the full authorized scope when no args are given', async () => {
        const { provider } = buildProvider(authContext);
        await expect(provider.getReadScope()).resolves.toEqual(['b-1', 'b-2']);
    });
    it('narrows to the requested args within the authorized scope', async () => {
        const { provider } = buildProvider(authContext);
        await expect(provider.getReadScope(['b-2'])).resolves.toEqual(['b-2']);
    });
    it('rejects args outside the authorized scope', async () => {
        const { provider } = buildProvider(authContext);
        await expect(provider.getReadScope(['b-9'])).rejects.toThrow(/outside the authorized read scope/);
    });
    it('throws when unauthenticated', async () => {
        const { provider } = buildProvider(null);
        await expect(provider.getReadScope()).rejects.toThrow(/Authentication required/);
    });
});
describe('ScopeProvider.resolveWriteTarget', () => {
    let provider;
    beforeEach(() => {
        provider = buildProvider(authContext).provider;
    });
    it('returns the target when it is a membership', async () => {
        await expect(provider.resolveWriteTarget('b-2')).resolves.toBe('b-2');
    });
    it('throws when no target is provided', async () => {
        await expect(provider.resolveWriteTarget(undefined)).rejects.toThrow(/explicit target businessId/);
    });
    it('throws when the target is not a membership', async () => {
        await expect(provider.resolveWriteTarget('b-9')).rejects.toThrow(/Not authorized to write/);
    });
});
describe('ScopeProvider.getBusinessPreference', () => {
    it('returns the requested preference for a business within scope', async () => {
        const { provider, getAdminContextByOwnerId } = buildProvider(authContext, {
            'b-2': { defaultLocalCurrency: 'USD' },
        });
        await expect(provider.getBusinessPreference('b-2', 'defaultLocalCurrency')).resolves.toBe('USD');
        expect(getAdminContextByOwnerId).toHaveBeenCalledWith('b-2');
    });
    it('returns null when the business has no admin context', async () => {
        const { provider } = buildProvider(authContext, {});
        await expect(provider.getBusinessPreference('b-2', 'defaultLocalCurrency')).resolves.toBeNull();
    });
    it('rejects a business outside the authorized read scope', async () => {
        const { provider } = buildProvider(authContext);
        await expect(provider.getBusinessPreference('b-9', 'defaultLocalCurrency')).rejects.toThrow(/outside the authorized read scope/);
    });
});
//# sourceMappingURL=scope.provider.test.js.map