import { describe, it, expect } from 'vitest';
import { generateApiKey, hashApiKey, looksLikeApiKey, validateApiKeyScope, validateApiKeyGlobalScope, validateApiKeyMediaScope, validateApiKeyPageBuilderScope, validateApiKeyIp, } from '../../security/api-key-enhanced.js';
describe('generateApiKey', () => {
    it('returns a key, hash, and prefix with the expected shape', async () => {
        const { key, keyHash, keyPrefix } = await generateApiKey({
            prefix: 'act_sk',
            scopes: { admin: true },
        });
        expect(key).toMatch(/^act_sk_[a-f0-9]{64}$/);
        expect(keyHash).toMatch(/^[a-f0-9]{64}$/);
        expect(keyPrefix.startsWith('act_sk_')).toBe(true);
        expect(keyPrefix.length).toBe(15);
    });
    it('produces unique keys on each call', async () => {
        const a = await generateApiKey({ prefix: 'act_sk', scopes: { admin: true } });
        const b = await generateApiKey({ prefix: 'act_sk', scopes: { admin: true } });
        expect(a.key).not.toBe(b.key);
        expect(a.keyHash).not.toBe(b.keyHash);
    });
    it('hashApiKey is deterministic for the same input', async () => {
        const { key } = await generateApiKey({ prefix: 'act_sk', scopes: { admin: true } });
        const h1 = await hashApiKey(key);
        const h2 = await hashApiKey(key);
        expect(h1).toBe(h2);
    });
});
describe('looksLikeApiKey', () => {
    it('matches valid act_sk_ tokens', () => {
        expect(looksLikeApiKey('act_sk_' + 'a'.repeat(64))).toBe(true);
        expect(looksLikeApiKey('act_sk_' + '0'.repeat(40))).toBe(true);
    });
    it('rejects non-API-key tokens', () => {
        expect(looksLikeApiKey('not_a_key')).toBe(false);
        expect(looksLikeApiKey('act_sk_short')).toBe(false);
        expect(looksLikeApiKey('eyJhbGciOiJIUzI1NiJ9.foo.bar')).toBe(false);
    });
});
describe('validateApiKeyScope', () => {
    it('admin scope always passes', () => {
        expect(validateApiKeyScope({ admin: true }, 'anything', 'delete')).toBe(true);
    });
    it('denies when no collections are configured', () => {
        expect(validateApiKeyScope({}, 'posts', 'read')).toBe(false);
    });
    it('denies when action is not in the actions list', () => {
        expect(validateApiKeyScope({ collections: ['posts'], actions: ['read'] }, 'posts', 'delete')).toBe(false);
    });
    it('allows when collection and action match', () => {
        expect(validateApiKeyScope({ collections: ['posts'], actions: ['read', 'create'] }, 'posts', 'create')).toBe(true);
    });
    it('wildcard collection matches anything', () => {
        expect(validateApiKeyScope({ collections: ['*'], actions: ['read'] }, 'random', 'read')).toBe(true);
    });
    it('does not match a different collection without wildcard', () => {
        expect(validateApiKeyScope({ collections: ['posts'], actions: ['read'] }, 'pages', 'read')).toBe(false);
    });
});
describe('validateApiKeyGlobalScope', () => {
    it('admin passes globals check', () => {
        expect(validateApiKeyGlobalScope({ admin: true }, 'site-settings')).toBe(true);
    });
    it('denies when no globals scope is granted', () => {
        expect(validateApiKeyGlobalScope({}, 'site-settings')).toBe(false);
    });
    it('matches explicit slug', () => {
        expect(validateApiKeyGlobalScope({ globals: ['site-settings'] }, 'site-settings')).toBe(true);
    });
    it('matches wildcard', () => {
        expect(validateApiKeyGlobalScope({ globals: ['*'] }, 'anything')).toBe(true);
    });
});
describe('validateApiKeyMediaScope', () => {
    it('admin passes', () => {
        expect(validateApiKeyMediaScope({ admin: true })).toBe(true);
    });
    it('media flag passes', () => {
        expect(validateApiKeyMediaScope({ media: true })).toBe(true);
    });
    it('without flag fails', () => {
        expect(validateApiKeyMediaScope({})).toBe(false);
    });
});
describe('validateApiKeyPageBuilderScope', () => {
    it('admin passes', () => {
        expect(validateApiKeyPageBuilderScope({ admin: true })).toBe(true);
    });
    it('pageBuilder flag passes', () => {
        expect(validateApiKeyPageBuilderScope({ pageBuilder: true })).toBe(true);
    });
    it('without flag fails', () => {
        expect(validateApiKeyPageBuilderScope({})).toBe(false);
    });
});
describe('validateApiKeyIp', () => {
    it('allows when no restrictions set', () => {
        expect(validateApiKeyIp(null, '1.2.3.4')).toBe(true);
        expect(validateApiKeyIp([], '1.2.3.4')).toBe(true);
        expect(validateApiKeyIp(undefined, '1.2.3.4')).toBe(true);
    });
    it('allows when IP is in the allowlist', () => {
        expect(validateApiKeyIp(['1.2.3.4', '5.6.7.8'], '5.6.7.8')).toBe(true);
    });
    it('denies when IP is not in the allowlist', () => {
        expect(validateApiKeyIp(['1.2.3.4'], '5.6.7.8')).toBe(false);
    });
    it('denies when client IP is unknown but restrictions are set', () => {
        expect(validateApiKeyIp(['1.2.3.4'], 'unknown')).toBe(false);
    });
});
//# sourceMappingURL=api-key-enhanced.test.js.map