import assert from 'node:assert/strict';
import test from 'node:test';
import { ForbiddenException } from '@nestjs/common';
import type { AuthPrincipal, AuthTransport } from '../../src/common/http/request-context';
import { assertMobileInspector } from '../../src/inspection-operations/mobile-inspector-policy';

function principal(transport: AuthTransport, roles: string[]): AuthPrincipal {
  return {
    userId: 'b6f6b10e-434a-4d72-9ec9-3520212dd290',
    username: 'inspector',
    sessionId: '1bab61ac-65d1-40e6-816b-63d90131a795',
    firstName: 'Inspector',
    lastName: 'DH',
    email: null,
    mustChangePassword: false,
    roles,
    permissions: [],
    transport,
  };
}

function forbiddenCode(error: unknown): string | undefined {
  return error instanceof ForbiddenException
    ? (error.getResponse() as { code?: string }).code
    : undefined;
}

test('operational inspection writes reject web cookie sessions', () => {
  assert.throws(
    () => assertMobileInspector(principal('cookie', ['inspector'])),
    (error: unknown) => forbiddenCode(error) === 'INSPECTION_MOBILE_APP_REQUIRED',
  );
});

test('operational inspection writes reject non-inspector bearer users', () => {
  assert.throws(
    () => assertMobileInspector(principal('bearer', ['admin'])),
    (error: unknown) => forbiddenCode(error) === 'INSPECTION_INSPECTOR_ROLE_REQUIRED',
  );
});

test('operational inspection writes accept inspector bearer users', () => {
  assert.doesNotThrow(() => assertMobileInspector(principal('bearer', ['inspector'])));
});