import assert from "node:assert/strict";
import { readFileSync } from "node:fs";
import test from "node:test";

import { authorizeAdminAccess } from "../src/lib/admin/auth-policy.ts";
import type { IdentityUser } from "../src/modules/identity/contracts.ts";

const adminAuthSource = readFileSync(
  new URL("../src/lib/admin/auth.ts", import.meta.url),
  "utf8",
);

function user(): IdentityUser {
  return {
    id: "11111111-1111-4111-8111-111111111111",
    email: "admin@example.com",
    emailVerified: true,
    twoFactorEnabled: false,
    name: "Admin",
    image: null,
    role: ["user"],
  };
}

test("anonymous admin access is 401", () => {
  assert.deepEqual(authorizeAdminAccess(null, [], "admin.access"), {
    allowed: false,
    status: 401,
  });
});

test("missing permission is 403", () => {
  assert.deepEqual(authorizeAdminAccess(user(), [], "admin.access"), {
    allowed: false,
    status: 403,
  });
  assert.deepEqual(authorizeAdminAccess(user(), ["admin.access"], "models.publish"), {
    allowed: false,
    status: 403,
  });
});

test("database permission keys authorize only the requested operation", () => {
  assert.deepEqual(authorizeAdminAccess(user(), ["admin.access"], "admin.access"), {
    allowed: true,
  });
  assert.deepEqual(authorizeAdminAccess(user(), ["models.read", "models.publish"], "models.publish"), {
    allowed: true,
  });
});


test("admin session guard requires the configured admin Host before session lookup", () => {
  const guard = adminAuthSource.slice(
    adminAuthSource.indexOf("export async function requirePermission"),
    adminAuthSource.indexOf("export function requireAdminSession"),
  );

  assert.match(guard, /readSelfHostedIdentityConfig\(process\.env\)/);
  assert.match(guard, /resolveIdentitySurface\(adminHeaders\.get\("host"\), identityConfig\) !== "admin"/);
  assert.ok(
    guard.indexOf("resolveIdentitySurface") < guard.indexOf("requireIdentityServerSession"),
    "Host must be rejected before Better Auth session lookup",
  );
  assert.doesNotMatch(guard, /x-forwarded-host|forwarded/i);
});