package httpapi

import (
	"testing"

	"github.com/easyai/easyai-ai-gateway/apps/api/internal/config"
	"github.com/easyai/easyai-ai-gateway/apps/api/internal/store"
)

func TestLocalLoginPolicyAlwaysPreservesBreakGlassManager(t *testing.T) {
	serverMain := &Server{cfg: config.Config{IdentityMode: "server-main"}}
	if !serverMain.localLoginAllowed(store.GatewayUser{Roles: []string{"manager"}}) {
		t.Fatal("server-main mode rejected a local break-glass manager")
	}
	if !serverMain.localLoginAllowed(store.GatewayUser{Roles: []string{"admin"}}) {
		t.Fatal("server-main mode rejected a local break-glass admin")
	}
	if serverMain.localLoginAllowed(store.GatewayUser{Roles: []string{"user"}}) {
		t.Fatal("server-main mode accepted an ordinary local user")
	}

	hybrid := &Server{cfg: config.Config{IdentityMode: "hybrid"}}
	if !hybrid.localLoginAllowed(store.GatewayUser{Roles: []string{"user"}}) {
		t.Fatal("hybrid mode rejected an ordinary local user")
	}
}