import type { Request } from 'express';
import { AdminController } from './admin.controller';

function makeReq(user: {
  oid: string;
  tid: string;
  username: string;
  displayName: string;
  amr: readonly string[];
  roles: readonly string[];
}): Request {
  return { session: { user } } as unknown as Request;
}

describe('AdminController', () => {
  it('GET /me returns the public payload of the admin user, including roles', () => {
    const controller = new AdminController();
    const res = controller.me(
      makeReq({
        oid: 'admin-oid',
        tid: 'tenant-1',
        username: 'admin@apf.example',
        displayName: 'Admin Smith',
        amr: ['pwd', 'mfa'],
        roles: ['admin'],
      }),
    );
    expect(res).toEqual({
      oid: 'admin-oid',
      tid: 'tenant-1',
      username: 'admin@apf.example',
      displayName: 'Admin Smith',
      roles: ['admin'],
    });
  });

  it('does not leak server-internal claims (`amr`) to the response', () => {
    const controller = new AdminController();
    const res = controller.me(
      makeReq({
        oid: 'admin-oid',
        tid: 'tenant-1',
        username: 'admin@apf.example',
        displayName: 'Admin Smith',
        amr: ['pwd', 'mfa'],
        roles: ['admin'],
      }),
    );
    expect(res).not.toHaveProperty('amr');
  });
});
