package auth

import (
	"strings"
	"testing"
)

func TestResolveStaffAccess(t *testing.T) {
	t.Parallel()

	cases := []struct {
		name     string
		admin    bool
		role     string
		wantRole string
		wantFull bool
		wantDesk bool
		wantOnly bool
	}{
		{name: "legacy_platform_admin", admin: true, role: "", wantRole: StaffRoleAdmin, wantFull: true, wantDesk: true},
		{name: "plain_user", admin: false, role: "", wantFull: false, wantDesk: false},
		{name: "support_staff", admin: false, role: StaffRoleSupportStaff, wantRole: StaffRoleSupportStaff, wantFull: false, wantDesk: true, wantOnly: true},
		{name: "support_staff_with_admin_flag", admin: true, role: StaffRoleSupportStaff, wantRole: StaffRoleSupportStaff, wantFull: false, wantDesk: true, wantOnly: true},
		{name: "admin_role", admin: true, role: StaffRoleAdmin, wantRole: StaffRoleAdmin, wantFull: true, wantDesk: true},
		{name: "developer_role", admin: false, role: StaffRoleDeveloper, wantRole: StaffRoleDeveloper, wantFull: true, wantDesk: true},
		{name: "unknown_role_ignored", admin: false, role: "superuser", wantFull: false, wantDesk: false},
	}
	for _, tc := range cases {
		tc := tc
		t.Run(tc.name, func(t *testing.T) {
			t.Parallel()
			got := ResolveStaffAccess(tc.admin, tc.role)
			if got.Role != tc.wantRole {
				t.Fatalf("role = %q, want %q", got.Role, tc.wantRole)
			}
			if got.FullAdmin != tc.wantFull || got.SupportDesk != tc.wantDesk || got.IsSupportOnly != tc.wantOnly {
				t.Fatalf("got full=%v desk=%v only=%v want full=%v desk=%v only=%v",
					got.FullAdmin, got.SupportDesk, got.IsSupportOnly, tc.wantFull, tc.wantDesk, tc.wantOnly)
			}
		})
	}
}

func TestStaffCapabilities(t *testing.T) {
	t.Parallel()
	adminCaps := StaffCapabilities(StaffRoleAdmin)
	if len(adminCaps) < 10 {
		t.Fatalf("admin caps too small: %v", adminCaps)
	}
	supportCaps := StaffCapabilities(StaffRoleSupportStaff)
	if len(supportCaps) != 4 {
		t.Fatalf("support caps = %v", supportCaps)
	}
	for _, c := range supportCaps {
		if strings.Contains(c, "billing") || strings.Contains(c, "settings") {
			t.Fatalf("support must not get %s", c)
		}
	}
}

func TestStaffRoleAllowsAdminRouteContract(t *testing.T) {
	t.Parallel()
	if !StaffRoleAllowsAdminRoute(StaffRoleSupportStaff, "/admin/support") {
		t.Fatal("support_staff should access /admin/support")
	}
	if StaffRoleAllowsAdminRoute(StaffRoleSupportStaff, "/admin/billing") {
		t.Fatal("support_staff must not access billing")
	}
	if !StaffRoleAllowsAdminRoute(StaffRoleDeveloper, "/admin/settings") {
		t.Fatal("developer should access settings")
	}
}

func TestNormalizeStaffRole(t *testing.T) {
	t.Parallel()
	if _, err := NormalizeStaffRole("nope"); err == nil {
		t.Fatal("expected error for invalid role")
	}
	got, err := NormalizeStaffRole(" Support_Staff ")
	if err != nil || got != StaffRoleSupportStaff {
		t.Fatalf("got %q err=%v", got, err)
	}
}