import { describe, it, expect } from 'vitest';
import { requiresReauth, DEFAULT_REAUTH_CONFIG } from '../../security/reauth.js';
describe('requiresReauth', () => {
    it('returns false for actions not in the required list', () => {
        const result = requiresReauth({ lastAuthAt: new Date(0), action: 'view_dashboard' }, DEFAULT_REAUTH_CONFIG);
        expect(result).toBe(false);
    });
    it('returns false when recently authenticated', () => {
        const result = requiresReauth({ lastAuthAt: new Date(), action: 'delete_user' }, DEFAULT_REAUTH_CONFIG);
        expect(result).toBe(false);
    });
    it('returns true when authentication is stale', () => {
        const staleDate = new Date(Date.now() - 600_000);
        const result = requiresReauth({ lastAuthAt: staleDate, action: 'delete_user' }, DEFAULT_REAUTH_CONFIG);
        expect(result).toBe(true);
    });
    it('returns true for change_settings when stale', () => {
        const staleDate = new Date(Date.now() - 600_000);
        const result = requiresReauth({ lastAuthAt: staleDate, action: 'change_settings' }, DEFAULT_REAUTH_CONFIG);
        expect(result).toBe(true);
    });
    it('respects custom maxAgeSeconds', () => {
        const config = { maxAgeSeconds: 10, requiredForActions: ['test_action'] };
        const recentEnough = new Date(Date.now() - 5_000);
        expect(requiresReauth({ lastAuthAt: recentEnough, action: 'test_action' }, config)).toBe(false);
        const tooOld = new Date(Date.now() - 15_000);
        expect(requiresReauth({ lastAuthAt: tooOld, action: 'test_action' }, config)).toBe(true);
    });
});
//# sourceMappingURL=reauth.test.js.map