import { describe, expect, it } from "vitest";

import {
  isAllowedAdminRegistration,
  isAuthorizedAdmin,
  isConfiguredAdminEmail,
} from "./authorization";

const verified = {
  id: "admin",
  email: "admin@example.com",
  emailVerified: true,
};

describe("admin authorization", () => {
  it("recognizes only the exact configured administrator email", () => {
    expect(isConfiguredAdminEmail(verified.email, "admin@example.com")).toBe(
      true,
    );
    expect(isConfiguredAdminEmail(verified.email, "ADMIN@example.com")).toBe(
      false,
    );
    expect(isConfiguredAdminEmail(verified.email, undefined)).toBe(false);
  });

  it("allows only credential registration for the configured administrator", () => {
    expect(
      isAllowedAdminRegistration(
        verified.email,
        "email-password",
        verified.email,
      ),
    ).toBe(true);
    expect(
      isAllowedAdminRegistration(
        "other@example.com",
        "email-password",
        verified.email,
      ),
    ).toBe(false);
    expect(
      isAllowedAdminRegistration(verified.email, "oauth", verified.email),
    ).toBe(false);
  });

  it("requires an exact verified email match", () => {
    expect(isAuthorizedAdmin(verified, "admin@example.com")).toBe(true);
    expect(isAuthorizedAdmin(verified, "ADMIN@example.com")).toBe(false);
    expect(
      isAuthorizedAdmin({ ...verified, emailVerified: false }, verified.email),
    ).toBe(false);
  });

  it("denies missing users and missing configuration", () => {
    expect(isAuthorizedAdmin(null, verified.email)).toBe(false);
    expect(isAuthorizedAdmin(verified, undefined)).toBe(false);
  });
});