import { describe, expect, it } from "@effect/vitest"; import { isTenantAdminMember, type TenantMemberRow } from "./admin-access"; const member = (overrides: Partial<TenantMemberRow> = {}): TenantMemberRow => ({  role: "member",  status: "active",  isCurrentUser: false,  ...overrides,}); describe("isTenantAdminMember", () => {  it("an active admin of the tenant may see the admin sections", () => {    expect(isTenantAdminMember([member({ role: "admin", isCurrentUser: true })])).toBe(true);  });   // Self-host (Better Auth) issues `owner` where cloud (WorkOS) issues `admin`;  // both hosts' admin middleware accept either.  it("self-host's owner role counts too", () => {    expect(isTenantAdminMember([member({ role: "owner", isCurrentUser: true })])).toBe(true);  });   it("a plain member does not", () => {    expect(isTenantAdminMember([member({ role: "member", isCurrentUser: true })])).toBe(false);  });   // A pending invite carries a role but no access yet — treating it as admin  // would show a section the server refuses.  it("a pending admin invite is not yet an admin", () => {    expect(      isTenantAdminMember([member({ role: "admin", status: "pending", isCurrentUser: true })]),    ).toBe(false);  });   it("another member's admin role says nothing about the viewer", () => {    expect(      isTenantAdminMember([        member({ role: "admin", isCurrentUser: false }),        member({ role: "member", isCurrentUser: true }),      ]),    ).toBe(false);  });   it("fails closed when the list has no row for the viewer", () => {    expect(isTenantAdminMember([])).toBe(false);    expect(isTenantAdminMember([member({ role: "admin" })])).toBe(false);  });   it("an unknown role is not an admin", () => {    expect(isTenantAdminMember([member({ role: "billing", isCurrentUser: true })])).toBe(false);  });});