import { MFA_AMR_VALUES, wasMultiFactor } from './mfa';

describe('MFA_AMR_VALUES', () => {
  it('covers the documented Entra MFA emission tokens', () => {
    // Spec assertion against the list per ADR-0011 §"BFF
    // verification". Changing this list is a deliberate ADR-recorded
    // decision; the test fails loudly when someone edits the const
    // without updating the ADR's confirmation block.
    expect([...MFA_AMR_VALUES]).toEqual(['mfa', 'otp', 'fido', 'wia', 'phr']);
  });
});

describe('wasMultiFactor', () => {
  it.each([
    [['mfa']],
    [['otp']],
    [['fido']],
    [['wia']],
    [['phr']],
    [['pwd', 'mfa']],
    [['mfa', 'pwd']],
    [['totp', 'pwd', 'fido']], // unknown token mixed in, fido still counts
  ])('returns true when amr=%j contains an MFA-class token', (amr) => {
    expect(wasMultiFactor(amr)).toBe(true);
  });

  it.each([
    [[]],
    [['pwd']],
    [['pwd', 'sms']], // 'sms' is not in our allow-list (Entra emits 'otp' instead)
    [['unknown']],
  ])('returns false when amr=%j carries no MFA-class token', (amr) => {
    expect(wasMultiFactor(amr)).toBe(false);
  });
});
