// KAR-779 / R62 — unit tests for canManageUser, the role-hierarchy gate the whole
// admin user-management surface relies on (invite, reset, lock/unlock, copy-link).
// Previously "correct by inspection but untested" (Phase-1 audit §H).
import { describe, it, expect } from 'vitest'
import { canManageUser } from '@/lib/auth/permissions-shared'
import type { UserSession, RoleCode } from '@/lib/auth/permissions-shared'

function session(role: RoleCode): UserSession {
  return {
    userId:             'u',
    authUserId:         'a',
    roleId:             'r',
    role,
    permissions:        [],
    displayName:        '',
    firstName:          '',
    lastName:           '',
    email:              '',
    avatarUrl:          null,
    departmentId:       null,
    mustChangePassword: false,
    accountStatus:      'active',
  }
}

const ALL_ROLES: RoleCode[] = ['masteradmin', 'admin', 'consultant', 'readonly', 'extern']

describe('canManageUser', () => {
  it('masteradmin can manage every role', () => {
    for (const target of ALL_ROLES) {
      expect(canManageUser(session('masteradmin'), target)).toBe(true)
    }
  })

  it('admin can manage everyone except masteradmin', () => {
    expect(canManageUser(session('admin'), 'masteradmin')).toBe(false)
    for (const target of ['admin', 'consultant', 'readonly', 'extern'] as RoleCode[]) {
      expect(canManageUser(session('admin'), target)).toBe(true)
    }
  })

  it('consultant can manage only consultants', () => {
    expect(canManageUser(session('consultant'), 'consultant')).toBe(true)
    for (const target of ['masteradmin', 'admin', 'readonly', 'extern'] as RoleCode[]) {
      expect(canManageUser(session('consultant'), target)).toBe(false)
    }
  })

  it('readonly and extern cannot manage anyone', () => {
    for (const actor of ['readonly', 'extern'] as RoleCode[]) {
      for (const target of ALL_ROLES) {
        expect(canManageUser(session(actor), target)).toBe(false)
      }
    }
  })

  // Regression for KAR-773: an admin must never be able to manage (e.g. lock) a masteradmin.
  it('KAR-773: admin cannot manage a masteradmin', () => {
    expect(canManageUser(session('admin'), 'masteradmin')).toBe(false)
  })
})