"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const vitest_1 = require("vitest");
const auth_js_1 = require("./auth.js");
(0, vitest_1.describe)('getDisplayName', () => {
    (0, vitest_1.test)('returns "IdP Token Passthrough" for OAUTH2_IDP_TOKEN_PASSTHROUGH', () => {
        (0, vitest_1.expect)((0, auth_js_1.getDisplayName)(auth_js_1.IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH)).toBe('IdP Token Passthrough');
    });
    (0, vitest_1.test)('returns "OAuth2 - On-Behalf-Of Token Exchange" for OAUTH2_TOKEN_EXCHANGE', () => {
        (0, vitest_1.expect)((0, auth_js_1.getDisplayName)(auth_js_1.IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE)).toBe('OAuth2 - On-Behalf-Of Token Exchange');
    });
    (0, vitest_1.test)('returns "None" for NONE', () => {
        (0, vitest_1.expect)((0, auth_js_1.getDisplayName)(auth_js_1.IntegrationAuthType.NONE)).toBe('None');
    });
});
(0, vitest_1.describe)('extractPublic', () => {
    (0, vitest_1.test)('returns empty object for OAUTH2_IDP_TOKEN_PASSTHROUGH (no secrets to expose)', () => {
        const authConfig = { clientId: 'test' };
        (0, vitest_1.expect)((0, auth_js_1.extractPublic)(auth_js_1.IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH, authConfig)).toEqual({});
    });
    (0, vitest_1.test)('returns token exchange fields for OAUTH2_TOKEN_EXCHANGE', () => {
        const authConfig = {
            clientId: 'my-client',
            clientSecret: 'my-secret',
            tokenUrl: 'https://token.example.com',
            audience: 'https://api.example.com',
            scope: 'read write',
            subjectTokenSource: 'SUBJECT_TOKEN_SOURCE_LOGIN_IDENTITY_PROVIDER',
            subjectTokenSourceStaticToken: 'static'
        };
        const result = (0, auth_js_1.extractPublic)(auth_js_1.IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE, authConfig);
        (0, vitest_1.expect)(result).toEqual({
            clientId: 'my-client',
            tokenUrl: 'https://token.example.com',
            audience: 'https://api.example.com',
            scope: 'read write',
            subjectTokenSource: 'SUBJECT_TOKEN_SOURCE_LOGIN_IDENTITY_PROVIDER',
            subjectTokenSourceStaticToken: 'static'
        });
        // clientSecret must not leak
        (0, vitest_1.expect)(result).not.toHaveProperty('clientSecret');
    });
    (0, vitest_1.test)('throws for unknown auth type', () => {
        (0, vitest_1.expect)(() => (0, auth_js_1.extractPublic)('totally-unknown-type', {})).toThrow('unknown auth type');
    });
});
(0, vitest_1.describe)('extractPublic normalizes boolean tokenScope for OAUTH2_CODE', () => {
    (0, vitest_1.test)('normalizes boolean true tokenScope to TokenScope.DATASOURCE', () => {
        const authConfig = {
            clientId: 'my-client',
            authorizationUrl: 'https://auth.example.com',
            tokenUrl: 'https://token.example.com',
            scope: 'read',
            tokenScope: true
        };
        const result = (0, auth_js_1.extractPublic)(auth_js_1.IntegrationAuthType.OAUTH2_CODE, authConfig);
        (0, vitest_1.expect)(result.tokenScope).toBe(auth_js_1.TokenScope.DATASOURCE);
    });
    (0, vitest_1.test)('normalizes boolean false tokenScope to TokenScope.USER', () => {
        const authConfig = {
            clientId: 'my-client',
            authorizationUrl: 'https://auth.example.com',
            tokenUrl: 'https://token.example.com',
            scope: 'read',
            tokenScope: false
        };
        const result = (0, auth_js_1.extractPublic)(auth_js_1.IntegrationAuthType.OAUTH2_CODE, authConfig);
        (0, vitest_1.expect)(result.tokenScope).toBe(auth_js_1.TokenScope.USER);
    });
    (0, vitest_1.test)('passes through valid string TokenScope unchanged', () => {
        const authConfig = {
            clientId: 'my-client',
            authorizationUrl: 'https://auth.example.com',
            tokenUrl: 'https://token.example.com',
            scope: 'read',
            tokenScope: auth_js_1.TokenScope.DATASOURCE
        };
        const result = (0, auth_js_1.extractPublic)(auth_js_1.IntegrationAuthType.OAUTH2_CODE, authConfig);
        (0, vitest_1.expect)(result.tokenScope).toBe(auth_js_1.TokenScope.DATASOURCE);
    });
    (0, vitest_1.test)('returns undefined for unknown string tokenScope values', () => {
        const authConfig = {
            clientId: 'my-client',
            authorizationUrl: 'https://auth.example.com',
            tokenUrl: 'https://token.example.com',
            scope: 'read',
            tokenScope: 'INVALID'
        };
        const result = (0, auth_js_1.extractPublic)(auth_js_1.IntegrationAuthType.OAUTH2_CODE, authConfig);
        (0, vitest_1.expect)(result.tokenScope).toBeUndefined();
    });
});
(0, vitest_1.describe)('getAuthId normalizes boolean tokenScope in getClientId', () => {
    (0, vitest_1.test)('uses integrationConfigurationId when tokenScope is boolean true (datasource)', () => {
        const authConfig = {
            clientId: 'my-client',
            tokenScope: true,
            scope: 'read'
        };
        const result = (0, auth_js_1.getAuthId)(auth_js_1.IntegrationAuthType.OAUTH2_CODE, authConfig, 'int-1', 'cfg-1');
        // When tokenScope is datasource, getClientId uses integrationConfigurationId (cfg-1)
        (0, vitest_1.expect)(result).toMatch(/^oauth-code\.cfg-1/);
    });
    (0, vitest_1.test)('uses clientId when tokenScope is boolean false (user)', () => {
        const authConfig = {
            clientId: 'my-client',
            tokenScope: false,
            scope: 'read'
        };
        const result = (0, auth_js_1.getAuthId)(auth_js_1.IntegrationAuthType.OAUTH2_CODE, authConfig, 'int-1', 'cfg-1');
        // When tokenScope is user, getClientId uses clientId (my-client)
        (0, vitest_1.expect)(result).toMatch(/^oauth-code\.my-client/);
    });
});
(0, vitest_1.describe)('getAuthId', () => {
    (0, vitest_1.test)('uses unknown-client for OAUTH2_IDP_TOKEN_PASSTHROUGH (no client identity)', () => {
        const authId = (0, auth_js_1.getAuthId)(auth_js_1.IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH, {}, 'int-1', 'cfg-1');
        (0, vitest_1.expect)(authId).toBe('oauth-idp-token-passthrough.unknown-client');
    });
    (0, vitest_1.test)('uses clientId for OAUTH2_TOKEN_EXCHANGE', () => {
        const authId = (0, auth_js_1.getAuthId)(auth_js_1.IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE, { clientId: 'my-client' }, 'int-1', 'cfg-1');
        // Token exchange builds: `clientId-hashedFields` — clientId prefix present
        (0, vitest_1.expect)(authId).toMatch(/^oauth-token-exchange\.my-client/);
    });
});
//# sourceMappingURL=auth.test.js.map