import { describe, expect, it } from 'vitest';
import {
  FUNCTIONAL_ROLES,
  PRIVILEGES,
  SCOPE_KINDS,
  isFunctionalRole,
  isPrivilege,
  isScopeKind,
} from './authorization.types';

describe('authorization catalogues', () => {
  // ADR-0025 §"Decision Outcome" promises specific counts. Locking
  // them down here makes a silent slug addition fail loudly — drift
  // between ADR text and code would defeat the closed-set posture.
  it('contains exactly 4 privileges, 24 functional roles, 6 scope kinds', () => {
    expect(PRIVILEGES).toHaveLength(4);
    expect(FUNCTIONAL_ROLES).toHaveLength(24);
    expect(SCOPE_KINDS).toHaveLength(6);
  });

  it('catalogues are deduplicated', () => {
    expect(new Set(PRIVILEGES).size).toBe(PRIVILEGES.length);
    expect(new Set(FUNCTIONAL_ROLES).size).toBe(FUNCTIONAL_ROLES.length);
    expect(new Set(SCOPE_KINDS).size).toBe(SCOPE_KINDS.length);
  });

  it('privilege entries are the 4 Portal.* values provisioned in the test tenant', () => {
    expect([...PRIVILEGES]).toEqual([
      'Portal.Admin',
      'Portal.Auditor',
      'Portal.SecurityOfficer',
      'Portal.DPO',
    ]);
  });

  it('isPrivilege narrows to known values, rejects unknown', () => {
    expect(isPrivilege('Portal.Admin')).toBe(true);
    expect(isPrivilege('Portal.RogueRole')).toBe(false);
    // Case-sensitive — Entra claim values are exact.
    expect(isPrivilege('portal.admin')).toBe(false);
  });

  it('isFunctionalRole narrows to known values, rejects unknown', () => {
    expect(isFunctionalRole('collaborateur')).toBe(true);
    expect(isFunctionalRole('directeur-etablissement')).toBe(true);
    expect(isFunctionalRole('partenaire')).toBe(true);
    expect(isFunctionalRole('unknown-role')).toBe(false);
  });

  it('isScopeKind narrows to known values, rejects unknown', () => {
    expect(isScopeKind('etablissement')).toBe(true);
    expect(isScopeKind('unrestricted')).toBe(true);
    expect(isScopeKind('etablissement:0330800013')).toBe(false);
  });
});
