import { beforeEach, describe, expect, it, vi } from 'vitest';
import { AuthorizationProvider } from '../authorization.provider.js';
describe('AuthorizationProvider', () => {
    let service;
    let mockAuthProvider;
    const businessOwnerUser = {
        userId: 'user-1',
        email: 'owner@example.com',
        roleId: 'business_owner',
        permissions: [],
        emailVerified: true,
        permissionsVersion: 1,
        auth0UserId: 'auth0|owner',
    };
    const accountantUser = {
        ...businessOwnerUser,
        userId: 'user-2',
        email: 'accountant@example.com',
        roleId: 'accountant',
        auth0UserId: 'auth0|accountant',
    };
    const employeeUser = {
        ...businessOwnerUser,
        userId: 'user-3',
        email: 'employee@example.com',
        roleId: 'employee',
        auth0UserId: 'auth0|employee',
    };
    const scraperUser = {
        ...businessOwnerUser,
        userId: 'user-4',
        email: 'scraper@example.com',
        roleId: 'scraper',
        auth0UserId: 'auth0|scraper',
    };
    beforeEach(() => {
        mockAuthProvider = {
            getAuthContext: vi.fn(),
        };
        service = new AuthorizationProvider(mockAuthProvider);
    });
    it('requireAuth returns user when authenticated', async () => {
        vi.mocked(mockAuthProvider.getAuthContext).mockResolvedValue({
            authType: 'jwt',
            user: businessOwnerUser,
            tenant: { businessId: 'biz-1', roleId: 'business_owner' },
        });
        const result = await service.requireAuth();
        expect(result).toEqual(businessOwnerUser);
    });
    it('requireAuth throws UNAUTHENTICATED when no user', async () => {
        vi.mocked(mockAuthProvider.getAuthContext).mockResolvedValue(null);
        await expect(service.requireAuth()).rejects.toMatchObject({
            extensions: { code: 'UNAUTHENTICATED' },
            message: 'Authentication required',
        });
    });
    it('requireRole returns user when role matches', async () => {
        vi.mocked(mockAuthProvider.getAuthContext).mockResolvedValue({
            authType: 'jwt',
            user: accountantUser,
            tenant: { businessId: 'biz-1', roleId: 'accountant' },
        });
        const result = await service.requireRole(['business_owner', 'accountant']);
        expect(result).toEqual(accountantUser);
    });
    it("requireRole throws FORBIDDEN when role doesn't match", async () => {
        vi.mocked(mockAuthProvider.getAuthContext).mockResolvedValue({
            authType: 'jwt',
            user: employeeUser,
            tenant: { businessId: 'biz-1', roleId: 'employee' },
        });
        await expect(service.requireRole(['business_owner', 'accountant'])).rejects.toMatchObject({
            extensions: { code: 'FORBIDDEN' },
            message: 'Access denied. Required roles: business_owner, accountant',
        });
    });
    it('requireBusinessOwner restricts to business_owner', async () => {
        vi.mocked(mockAuthProvider.getAuthContext).mockResolvedValue({
            authType: 'jwt',
            user: accountantUser,
            tenant: { businessId: 'biz-1', roleId: 'accountant' },
        });
        await expect(service.requireBusinessOwner()).rejects.toMatchObject({
            extensions: { code: 'FORBIDDEN' },
        });
        vi.mocked(mockAuthProvider.getAuthContext).mockResolvedValue({
            authType: 'jwt',
            user: businessOwnerUser,
            tenant: { businessId: 'biz-1', roleId: 'business_owner' },
        });
        const result = await service.requireBusinessOwner();
        expect(result).toEqual(businessOwnerUser);
    });
    it('canWrite allows business_owner and accountant; blocks employee and scraper', async () => {
        vi.mocked(mockAuthProvider.getAuthContext).mockResolvedValue({
            authType: 'jwt',
            user: businessOwnerUser,
            tenant: { businessId: 'biz-1', roleId: 'business_owner' },
        });
        await expect(service.canWrite()).resolves.toEqual(businessOwnerUser);
        vi.mocked(mockAuthProvider.getAuthContext).mockResolvedValue({
            authType: 'jwt',
            user: accountantUser,
            tenant: { businessId: 'biz-1', roleId: 'accountant' },
        });
        await expect(service.canWrite()).resolves.toEqual(accountantUser);
        vi.mocked(mockAuthProvider.getAuthContext).mockResolvedValue({
            authType: 'jwt',
            user: employeeUser,
            tenant: { businessId: 'biz-1', roleId: 'employee' },
        });
        await expect(service.canWrite()).rejects.toMatchObject({
            extensions: { code: 'FORBIDDEN' },
        });
        vi.mocked(mockAuthProvider.getAuthContext).mockResolvedValue({
            authType: 'jwt',
            user: scraperUser,
            tenant: { businessId: 'biz-1', roleId: 'scraper' },
        });
        await expect(service.canWrite()).rejects.toMatchObject({
            extensions: { code: 'FORBIDDEN' },
        });
    });
});
//# sourceMappingURL=authorization.provider.test.js.map