import { describe, test, expect } from 'vitest';
import { IntegrationAuthType, getDisplayName, extractPublic, getAuthId, TokenScope } from './auth.js';
describe('getDisplayName', () => {
    test('returns "IdP Token Passthrough" for OAUTH2_IDP_TOKEN_PASSTHROUGH', () => {
        expect(getDisplayName(IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH)).toBe('IdP Token Passthrough');
    });
    test('returns "OAuth2 - On-Behalf-Of Token Exchange" for OAUTH2_TOKEN_EXCHANGE', () => {
        expect(getDisplayName(IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE)).toBe('OAuth2 - On-Behalf-Of Token Exchange');
    });
    test('returns "None" for NONE', () => {
        expect(getDisplayName(IntegrationAuthType.NONE)).toBe('None');
    });
});
describe('extractPublic', () => {
    test('returns empty object for OAUTH2_IDP_TOKEN_PASSTHROUGH (no secrets to expose)', () => {
        const authConfig = { clientId: 'test' };
        expect(extractPublic(IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH, authConfig)).toEqual({});
    });
    test('returns token exchange fields for OAUTH2_TOKEN_EXCHANGE', () => {
        const authConfig = {
            clientId: 'my-client',
            clientSecret: 'my-secret',
            tokenUrl: 'https://token.example.com',
            audience: 'https://api.example.com',
            scope: 'read write',
            subjectTokenSource: 'SUBJECT_TOKEN_SOURCE_LOGIN_IDENTITY_PROVIDER',
            subjectTokenSourceStaticToken: 'static'
        };
        const result = extractPublic(IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE, authConfig);
        expect(result).toEqual({
            clientId: 'my-client',
            tokenUrl: 'https://token.example.com',
            audience: 'https://api.example.com',
            scope: 'read write',
            subjectTokenSource: 'SUBJECT_TOKEN_SOURCE_LOGIN_IDENTITY_PROVIDER',
            subjectTokenSourceStaticToken: 'static'
        });
        // clientSecret must not leak
        expect(result).not.toHaveProperty('clientSecret');
    });
    test('throws for unknown auth type', () => {
        expect(() => extractPublic('totally-unknown-type', {})).toThrow('unknown auth type');
    });
});
describe('extractPublic normalizes boolean tokenScope for OAUTH2_CODE', () => {
    test('normalizes boolean true tokenScope to TokenScope.DATASOURCE', () => {
        const authConfig = {
            clientId: 'my-client',
            authorizationUrl: 'https://auth.example.com',
            tokenUrl: 'https://token.example.com',
            scope: 'read',
            tokenScope: true
        };
        const result = extractPublic(IntegrationAuthType.OAUTH2_CODE, authConfig);
        expect(result.tokenScope).toBe(TokenScope.DATASOURCE);
    });
    test('normalizes boolean false tokenScope to TokenScope.USER', () => {
        const authConfig = {
            clientId: 'my-client',
            authorizationUrl: 'https://auth.example.com',
            tokenUrl: 'https://token.example.com',
            scope: 'read',
            tokenScope: false
        };
        const result = extractPublic(IntegrationAuthType.OAUTH2_CODE, authConfig);
        expect(result.tokenScope).toBe(TokenScope.USER);
    });
    test('passes through valid string TokenScope unchanged', () => {
        const authConfig = {
            clientId: 'my-client',
            authorizationUrl: 'https://auth.example.com',
            tokenUrl: 'https://token.example.com',
            scope: 'read',
            tokenScope: TokenScope.DATASOURCE
        };
        const result = extractPublic(IntegrationAuthType.OAUTH2_CODE, authConfig);
        expect(result.tokenScope).toBe(TokenScope.DATASOURCE);
    });
    test('returns undefined for unknown string tokenScope values', () => {
        const authConfig = {
            clientId: 'my-client',
            authorizationUrl: 'https://auth.example.com',
            tokenUrl: 'https://token.example.com',
            scope: 'read',
            tokenScope: 'INVALID'
        };
        const result = extractPublic(IntegrationAuthType.OAUTH2_CODE, authConfig);
        expect(result.tokenScope).toBeUndefined();
    });
});
describe('getAuthId normalizes boolean tokenScope in getClientId', () => {
    test('uses integrationConfigurationId when tokenScope is boolean true (datasource)', () => {
        const authConfig = {
            clientId: 'my-client',
            tokenScope: true,
            scope: 'read'
        };
        const result = getAuthId(IntegrationAuthType.OAUTH2_CODE, authConfig, 'int-1', 'cfg-1');
        // When tokenScope is datasource, getClientId uses integrationConfigurationId (cfg-1)
        expect(result).toMatch(/^oauth-code\.cfg-1/);
    });
    test('uses clientId when tokenScope is boolean false (user)', () => {
        const authConfig = {
            clientId: 'my-client',
            tokenScope: false,
            scope: 'read'
        };
        const result = getAuthId(IntegrationAuthType.OAUTH2_CODE, authConfig, 'int-1', 'cfg-1');
        // When tokenScope is user, getClientId uses clientId (my-client)
        expect(result).toMatch(/^oauth-code\.my-client/);
    });
});
describe('getAuthId', () => {
    test('uses unknown-client for OAUTH2_IDP_TOKEN_PASSTHROUGH (no client identity)', () => {
        const authId = getAuthId(IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH, {}, 'int-1', 'cfg-1');
        expect(authId).toBe('oauth-idp-token-passthrough.unknown-client');
    });
    test('uses clientId for OAUTH2_TOKEN_EXCHANGE', () => {
        const authId = getAuthId(IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE, { clientId: 'my-client' }, 'int-1', 'cfg-1');
        // Token exchange builds: `clientId-hashedFields` — clientId prefix present
        expect(authId).toMatch(/^oauth-token-exchange\.my-client/);
    });
});
//# sourceMappingURL=auth.test.js.map