import assert from "node:assert/strict";
import { describe, it } from "node:test";
import { isFullPlatformAdmin, shouldUnlockAllFeatures } from "./staff-access.ts";

describe("isFullPlatformAdmin", () => {
	it("allows staff_access.full_admin", () => {
		assert.equal(isFullPlatformAdmin({ staff_access: { full_admin: true } }), true);
	});

	it("denies support_staff even when legacy is_platform_admin is set", () => {
		assert.equal(
			isFullPlatformAdmin({
				staff_access: { full_admin: false, support_desk: true, is_support_only: true },
				user: { is_platform_admin: true }
			}),
			false
		);
	});

	it("denies when staff_access is present without full_admin", () => {
		assert.equal(isFullPlatformAdmin({ staff_access: {} }), false);
	});

	it("legacy: allows is_platform_admin when staff_access is absent", () => {
		assert.equal(isFullPlatformAdmin({ user: { is_platform_admin: true } }), true);
	});

	it("legacy: denies when neither staff_access nor is_platform_admin", () => {
		assert.equal(isFullPlatformAdmin({ user: { is_platform_admin: false } }), false);
		assert.equal(isFullPlatformAdmin({}), false);
		assert.equal(isFullPlatformAdmin(null), false);
	});

	it("treats null staff_access as legacy path", () => {
		assert.equal(
			isFullPlatformAdmin({ staff_access: null, user: { is_platform_admin: true } }),
			true
		);
	});
});

describe("shouldUnlockAllFeatures", () => {
	it("unlocks Demo / full admin", () => {
		assert.equal(
			shouldUnlockAllFeatures({
				staff_access: { full_admin: true, support_desk: true },
				user: { is_platform_admin: true }
			}),
			true
		);
	});

	it("does not unlock normal A1 tenant (no staff)", () => {
		assert.equal(
			shouldUnlockAllFeatures({
				user: { is_platform_admin: false }
			}),
			false
		);
	});

	it("does not unlock via legacy is_platform_admin when staff_access denies full_admin", () => {
		assert.equal(
			shouldUnlockAllFeatures({
				staff_access: { full_admin: false },
				user: { is_platform_admin: true }
			}),
			false
		);
	});

	it("does not unlock on || style leak (staff_access full_admin false)", () => {
		// Regression: Boolean(full_admin || is_platform_admin) would be true here.
		const me = {
			staff_access: { full_admin: false, support_desk: true },
			user: { is_platform_admin: true }
		};
		assert.equal(Boolean(me.staff_access?.full_admin || me.user?.is_platform_admin), true);
		assert.equal(shouldUnlockAllFeatures(me), false);
	});
});