import { describe, expect, it } from 'vitest';
import type { AuthUser } from '@easyai-ai-gateway/contracts';
import { canAccessAdminWorkspace } from './auth-permissions';

function userWithRoles(role?: string[]): AuthUser {
  return { sub: 'user-1', username: 'test-user', role };
}

describe('canAccessAdminWorkspace', () => {
  it.each(['admin', 'manager', 'operator'])('allows the %s role', (role) => {
    expect(canAccessAdminWorkspace(userWithRoles([role]))).toBe(true);
  });

  it.each([undefined, [], ['user'], ['creator']])('rejects non-admin roles: %j', (roles) => {
    expect(canAccessAdminWorkspace(userWithRoles(roles))).toBe(false);
  });

  it('rejects an unresolved user', () => {
    expect(canAccessAdminWorkspace(null)).toBe(false);
  });
});
